Lightning tightens BOLT11 invoice rules after withdrawal attack
- —BOLT11 now mandates exactly one payment hash (p) and one payment secret (s), or the payment must fail
- —lnd merged duplicate-hash rejection on Sept. 23; releases v0.20.5-beta and v0.21.4-beta include the fix
- —Broader payment-secret checks sit in a separate lnd proposal still open as of Oct. 27
- —The attack exploited parsers that read either the first or the last payment hash in an invoice
Why it matters: The flaw let services treat a completed withdrawal as unpaid and pay out again, so the fix affects every Lightning payment operator.
Source: CryptoSlate