advisories: Eclair exhausts CPU and memory from a race that orphans channel actors by morehouse · Pull Request #13 · lnfuzz/lnfuzz.github.io

morehouse · 2026-09-30T11:22:53Z

No description provided.

morehouse · 2026-09-30T11:23:45Z

+The first `open_channel` inserts the channel; the second sees the entry and is dropped, so no orphan is ever created.
+And with the race closed there are no duplicate admissions for the rate limiter to mishandle.
+
+The same PR also hardened the early duplicate check to compare a `temporary_channel_id` against existing final `channel_id`s, addressing a related ID-confusion issue found by Erick Cestari.


@erickcestari I'll add the link to your disclosure here when it's published.

I've published mine disclosure. Once the advisory is published, I’ll also update it to include a link to the advisory.

https://erickcestari.dev/blog/eclair-oom-pending-channels/

Added the link.

NishantBansal2003

LGTM!

NishantBansal2003 · 2026-09-30T17:28:20Z

+  }
+```
+
+The channel map is consulted, and if no duplicate is found an asynchronous round trip through the interceptor is initiated.


Suggested change

The channel map is consulted, and if no duplicate is found an asynchronous round trip through the interceptor is initiated.

The channel map is consulted, and if no duplicate is found, an asynchronous round trip through the interceptor is initiated.

Arvin21M

Approved, with a few edit requests.
Marked as approved because the suggested edits are not critical.

Arvin21M · 2026-09-30T18:07:59Z

+Eclair spawns two channel actors for the `temporary_channel_id`, and each answers with its own `accept_channel`.
+The second insertion overwrites the first under the same key, and the first actor becomes orphaned:
+
+- it is no longer in the channel map, so no further messages can reach it, and


Suggested change

- it is no longer in the channel map, so no further messages can reach it, and

- it is no longer in the channel map, so no further channel messages routed through the `Peer` can reach it, and

Arvin21M · 2026-09-30T18:10:15Z

+case Event(TickChannelOpenTimeout, _) => stay()
+```
+
+The only thing that reaps the orphan is a peer disconnect, so the orphan stays in memory as long as the attacker remains connected.


Suggested change

The only thing that reaps the orphan is a peer disconnect, so the orphan stays in memory as long as the attacker remains connected.

The only thing that reaps the orphan in testing is a peer disconnect, so the orphan stays in memory as long as the attacker remains connected.

I skipped this suggestion. It's true that nothing else reaped it in testing, but I'm also fairly confident that nothing else can reap it at all.

Arvin21M · 2026-09-30T18:11:12Z

+  - the node froze, unable to process incoming messages, until the attacking peer was eventually disconnected.
+    On disconnect, the leaked memory was freed and Eclair was able to recover.
+
+The Eclair node came back on restart or disconnect, and nothing was lost.


Suggested change

The Eclair node came back on restart or disconnect, and nothing was lost.

The Eclair node came back on restart or disconnect, and nothing was lost in testing.

Skipped this suggestion. I think "in testing" is redundant since the entire section is describing what we observed in our test.

Arvin21M · 2026-09-30T18:13:17Z

+
+The Eclair node came back on restart or disconnect, and nothing was lost.
+The attacker could repeat the attack, but it took four more hours to reach the end state again.
+Eclair had plenty of time to handle on-chain events, and funds were not seriously at risk.


Suggested change

Eclair had plenty of time to handle on-chain events, and funds were not seriously at risk.

Eclair had plenty of time to handle on-chain events in testing, and no loss of funds were observed.

I agree the "funds were not seriously at risk" statement may be too strong. But I don't want to say "no loss was observed" since we didn't even try to steal funds in the experiment.

I've changed the sentence to "This delay gives Eclair plenty of time to handle on-chain events, so the risk to funds is likely low." I think this hedges enough without implying we tried to steal funds.

Arvin21M · 2026-09-30T18:16:50Z

+
+Because the `Peer` actor processes one message at a time and the check now shares its turn with the insertion, there is no longer a gap for a second `open_channel` to race through.
+The first `open_channel` inserts the channel; the second sees the entry and is dropped, so no orphan is ever created.
+And with the race closed there are no duplicate admissions for the rate limiter to mishandle.


Consider editing to:
"And with the race closed there are no orphaned actors for the rate limiter behavior to leave behind."

I agree that "duplicate admissions" sounds funny, but it's not 100% accurate to say the rate limiter was leaving behind orphans.

Instead I changed the phrase to "duplicate temporary_channel_ids".

erickcestari

LGTM!

…hannel actors

morehouse · 2026-09-30T20:20:06Z

Thank you all for the reviews!

morehouse commented Sep 30, 2026

View reviewed changes

morehouse requested review from NishantBansal2003 and erickcestari September 30, 2026 11:24

NishantBansal2003 approved these changes Sep 30, 2026

View reviewed changes

morehouse requested a review from Arvin21M September 30, 2026 17:48

Arvin21M approved these changes Sep 30, 2026

View reviewed changes

erickcestari approved these changes Sep 30, 2026

View reviewed changes

advisories: Eclair exhausts CPU and memory from a race that orphans c…

7cd1376

…hannel actors

morehouse force-pushed the eclair-open-channel-race-dos branch from c2f249b to 7cd1376 Compare September 30, 2026 20:18

morehouse merged commit 35e6e05 into master Sep 30, 2026
1 check passed

morehouse deleted the eclair-open-channel-race-dos branch September 30, 2026 20:20

	The channel map is consulted, and if no duplicate is found an asynchronous round trip through the interceptor is initiated.
	The channel map is consulted, and if no duplicate is found, an asynchronous round trip through the interceptor is initiated.

	- it is no longer in the channel map, so no further messages can reach it, and
	- it is no longer in the channel map, so no further channel messages routed through the `Peer` can reach it, and

	The only thing that reaps the orphan is a peer disconnect, so the orphan stays in memory as long as the attacker remains connected.
	The only thing that reaps the orphan in testing is a peer disconnect, so the orphan stays in memory as long as the attacker remains connected.

	The Eclair node came back on restart or disconnect, and nothing was lost.
	The Eclair node came back on restart or disconnect, and nothing was lost in testing.

	Eclair had plenty of time to handle on-chain events, and funds were not seriously at risk.
	Eclair had plenty of time to handle on-chain events in testing, and no loss of funds were observed.

Conversation

morehouse commented Sep 30, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

NishantBansal2003 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Arvin21M left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

erickcestari left a comment

Choose a reason for hiding this comment

Uh oh!

morehouse commented Sep 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants