ldk · LDK
LDK releases 0.1.13, 0.2.7 and 0.3-rc3 with vulnerability fixes, including fund theft
The Lightning Dev Kit team has reported several security vulnerabilities in LDK, including the possibility of fund theft. Fixes have been released in versions 0.1.13, 0.2.7 and 0.3-rc3. Those running LDK in production with untrusted channel counterparties are primarily at risk: a malicious counterparty is precisely the scenario addressed by the fix. The 0.3 branch remains in testing, with rc3 current for that branch.
Actions to take
Update LDK today to 0.1.13 or 0.2.7, depending on your branch — especially if your node works with untrusted channel counterparties. If you are testing 0.3, move to rc3 and read the compatibility notes before updating — the releases are linked in the post.