Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
lightningnetwork/lnd
master @ 1e8b76a
138
Fixes
7
CVEs
CRITICAL
Peak severity
51.4%
Coverage
Highlights
Denial of Service: 91 prior fixes. Scrutinize any change in this area.
fundingmanager.go: most-fixed (8 issues). Treat as high-risk during review.
49 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Cryptographic Issues: Reusing Musig2 nonces across RBF rounds of cooperative closes can leak the user's private key. The fix requires immediate nonce invalidation between signing rounds to prevent state retention.
Denial of Service: Onion message parsing and Sybil traffic can exhaust node memory and queue resources. Mitigations require enforcing strict byte-granular per-peer and global rate-limiting at ingress, as well as gating onion routing on active channels.
Auth Bypass: Allowing empty signatures to satisfy channel validation logic bypasses the public channel authentication checks. Empty signatures must be explicitly rejected as missing or invalid.