Fuzzing the Lightning Network.
We look for bugs in the Bitcoin Lightning Network using fuzzing and other techniques, publishing what we find.
Eclair v0.14.0 and earlier have a TOCTOU race that can cause channel actors to be leaked, and repeated execution of the race leaks memory until the JVM crashes or the garbage collector pegs every core.
Eclair v0.13.1 and earlier still accept the zlib encoding type that BOLT 7 retired in 2022 and inflate it with no size limit, so a flood of zlib-encoded channel queries disconnects a node's peers, stalls its API and block processing, and drives the JVM out of memory within minutes.
Eclair v0.13.1 and earlier allocate several heap objects per feature bit when parsing a message, so a flood of maximum-length init messages disconnects a node's peers, stalls its API and block processing, and drives the JVM out of memory within five minutes.
A coverage-guided snapshot fuzzer for Lightning Network implementations.
37 bugs found across 4 implementations, 15 fixed.