Full-Disclosure: CVE-2025-27586 "No Santa Claus under the Lightning Sun"

This vector of attack leverages the absence of a well-defined mechanism for provisioning fee reserves necessary for the timely inclusion of transactions, particularly under the option_anchor channels upgrade. The issue roots back to early deployments of anchor outputs across the network around the end of 2020, with discussions among LN maintainers surfacing by mid-2022. Despite some mitigations being developed and implemented across various LN implementations, the consensus suggests that a more robust, protocol-level solution is required yet appears unlikely due to the complexity of implementing such changes within an embargoed process.

Anchor outputs were introduced to allow non-interactive fee bumping via CPFP (Child Pays For Parent) transactions, enabling nodes to increase transaction fees unilaterally to ensure timeliness in block inclusion—critical for operations like claiming HTLCs (Hash Time-Locked Contracts). However, the initial specifications did not address how nodes should manage or provision external fee-bumping reserves, leading to potential vulnerabilities where an attacker could deliberately exhaust a node's fee reserves through channel inflation tactics. Such actions could jeopardize the ability of a node to perform necessary transactions before HTLC expiry, thus posing a risk of financial loss.

Key to exploiting this vulnerability is the adversary's ability to estimate a target node's fee-bumping reserve levels, a task that can be approached through heuristic methods such as monitoring unilateral force-closures or analyzing on-chain behavior related to UTXO management. Mitigation strategies involve over-provisioning fee reserves based on worst-case scenarios, halting the growth of a node's overall channel weight surface, and cooperative efforts among LN nodes to reduce commitment transaction sizes.

This disclosure emphasizes the ongoing challenges within the LN ecosystem regarding dynamic fee management and highlights the need for collective action towards developing and adopting more comprehensive solutions to safeguard against such vulnerabilities. The report, including its background, problem statement, potential impact, and proposed mitigations, is made publicly available here, alongside a call for further research and collaboration within the community to address these critical issues.

In conclusion, the revelation of CVE-2025-27586 signifies a pivotal moment for the Lightning Network and Bitcoin's underlying security framework, underscoring the delicate balance between innovation and the requisite safeguards needed to protect the network and its participants from sophisticated threats.