Lightning Labs discloses critical bug marking canceled invoices paid, risking free product delivery
Summary
Lightning Labs disclosed a high-severity flaw in older Lightning Terminal and lnd versions that could show a Bitcoin Lightning invoice as paid after its payment was canceled and returned to the sender. Merchants relying on that status could release goods or credit without receiving funds; the advisory reports no tally of losses and says senders’ funds were not at risk. The bug involved tapd canceling certain HTLCs and lnd incorrectly recording canceled payments as settled. Lightning Labs says the issue did not affect Bitcoin’s base chain. Fixes shipped in tapd v0.5.1 and lnd v0.19.0-beta during 2025; Terminal v0.15.0-alpha bundles both. Operators unable to update can disable Taproot Assets mode to avoid the identified trigger.
