|

Lightning Labs discloses critical bug marking canceled invoices paid, risking free product delivery

Diagram showing an ordinary BTC payment with a custom record, tapd cancellation, payment returned to sender, an invoice marked settled, and the 2025 tapd and lnd fixes.

A flaw in older Lightning Terminal software program might mark a Bitcoin Lightning bill paid after the fee was cancelled and returned to its sender, Lightning Labs disclosed on Sept. 21, 2026.

A service provider counting on that bill standing could release goods or credit with out receiving funds. The firm describes that danger however provides no tally of precise service provider losses.

The problem was a mismatch between the software program’s bill document and the fee’s consequence. A Lightning fee makes use of a hashed time-locked contract (HTLC) to hold funds.

In this case, the HTLC was canceled on the community and returned to the sender, whereas the receiving node nonetheless recorded the bill as settled. The advisory doesn’t describe a failure of Bitcoin’s base chain.

Lightning Terminal bundles tapd, software program for Taproot Assets, with the lnd Lightning node. In the affected setup, tapd enabled its bill interceptor and handled any HTLC carrying customized wire information as an asset fee.

Some sender implementations added an experimental endorsement document even to peculiar BTC funds, inflicting tapd’s strict-forwarding rule to instruct lnd to cancel the HTLC set. The set off didn’t require the service provider to have any open asset channels.

Diagram showing an ordinary BTC payment with a custom record, tapd cancellation, payment returned to sender, an invoice marked settled, and the 2025 tapd and lnd fixes.
Lightning Labs patched a flaw the place canceled Bitcoin funds might nonetheless seem settled on service provider invoices, risking items or credit score with out fee.

The second defect sat in lnd. When an interceptor canceled the HTLC set, affected variations canceled the fee on the wire however nonetheless marked its bill as settled within the database.

That meant the error stood in one other consumer of lnd’s HtlcModifier interface that canceled an HTLC set might produce the identical mismatch. Lightning Labs rates the vulnerability high severity as a result of a false paid standing may lead an operator or fee service to launch worth in opposition to a fee that by no means accomplished. According to the advisory, the sender’s funds weren’t in danger.

Related Reading

Malicious bots are actively probing exposed Bitcoin payment servers to steal master administrative keys

Fixes shipped earlier than disclosure

Lightning Terminal v0.15.0-alpha bundles fixes for each defects. Lightning Labs lists earlier Terminal variations as affected, together with taproot property by means of v0.5.0 and lnd 0.18.4-beta by means of 0.18.5-beta.

The tapd set off was fastened in v0.5.1 on Feb. 12, 2025. Terminal v0.14.1-alpha included that repair, however its bundled lnd model nonetheless had the underlying invoice-state defect.

lnd v0.19.0-beta fastened the accounting error on May 22, 2025. The September 2026 advisory due to this fact disclosed a vulnerability whose related fixes had shipped in 2025. For Terminal operators who can not replace and haven’t any asset channels, Lightning Labs identifies --taproot-assets-mode=disable as a option to keep away from the noticed tapd set off.

The put up Lightning Labs discloses critical bug marking canceled invoices paid, risking free product delivery appeared first on CryptoSlate.

Similar Posts