University of Illinois warns of Lightning Network vulnerability

Article Reading Time:
2 minutes.

Researchers at the University of Illinois reported that the Lightning Network is potentially vulnerable to a "zombie" attack and a coordinated double-spend attack.

Cosimo Sguanci and Anastasios Sidiropoulos from the University of Illinois have discovered a vulnerability in the second-layer solution for the Bitcoin Lightning Network.They published an article describing a hypothetical attack based on the collusion of node operators, in which a coalition of 30 nodes couldsteal 750 BTC ($17 million).

Experts added that attackers will be able to control a certain number of nodes and disable channels using a "zombie" attack.A zombie attack occurs when multiple nodes become unresponsive, locking assets on any channel connected to those nodes.

To defend against a zombie attack, honest nodes must close their channels and exit the Lightning Network.This requires high transaction fees, renders Lightning Network channels unusable, and congestsThus, a massive double-spend attack would be more profitable than a "zombie" attack.

According to experts, attackers can collude with several dozen large nodes and overload the Bitcoin network, sending a stream of fraudulent transactions to close a large number of channels on the Lightning Network.If the attackers pay a high fee and get ahead in the queue, they will be able toSpend Bitcoins twice. 

Experts believe that honest nodes will be able to protect themselves from a mass double-spend attack by sending so-called "fairness transactions", challenging fraudulent requests to close the channel.In the course of the attack, attackers will compete with honest nodes in persuading miners to enable fraudulent transactions before honest transactions. 

If honest nodes can't pay miners enough to enable their transactions, the attackers will win.As a defense against a double-spend attack, the researchers suggested increasing the variable "to_safe_delay," which addsan additional charge for a longer wait if the user decides to close the channel without any response fromyour counterparty.

Recall that in March, the number of bitcoins locked on the Lightning Network exceeded 3,500 BTC.