# DoS disclosure: Channel open race in CLN

**URL:** <https://delvingbitcoin.org/t/dos-disclosure-channel-open-race-in-cln/385>\
**Category:** Implementation\
**Tags:** lightning\
**Created:** [January 8, 2024, 7:01pm UTC](https://delvingbitcoin.org/t/dos-disclosure-channel-open-race-in-cln/385 "2024-01-08T19:01:42Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![morehouse](https://delvingbitcoin.org/letter_avatar_proxy/v4/letter/m/df705f/32.png) [@morehouse](https://delvingbitcoin.org/u/morehouse)\
**Post date:** [January 8, 2024, 7:01pm UTC](https://delvingbitcoin.org/t/dos-disclosure-channel-open-race-in-cln/385/1 "2024-01-08T19:01:42Z")

</div>

CLN versions between [23.02](https://github.com/ElementsProject/lightning/releases/tag/v23.02) and [23.05.2](https://github.com/ElementsProject/lightning/releases/tag/v23.05.2) are susceptible to a DoS attack involving the exploitation of a race condition during channel opens. If you are running any version in this range, your funds may be at risk! Update to at least CLN [23.08](https://github.com/ElementsProject/lightning/releases/tag/v23.08) to help protect your node.

# The Vulnerability

The vulnerability arises from a race condition between two different flows in CLN: the channel open flow and the peer connection flow. When the race occurs, CLN attempts to launch a `channeld` daemon twice, triggering an assertion failure and a crash.

The crash can be reliably triggered in 30 seconds using a [fake channel DoS attack](https://morehouse.github.io/lightning/fake-channel-dos/).

# Protecting Your Node

Update your node to at least [v23.08](https://github.com/ElementsProject/lightning/releases/tag/v23.08) to prevent it from crashing due to the race.

# More Details

For a full discussion about the vulnerability, its root causes, and how it could have been prevented, see my [blog post](https://morehouse.github.io/lightning/cln-channel-open-race/) about it.