{"id":13692,"date":"2026-09-25T01:23:57","date_gmt":"2026-09-25T01:23:57","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=13692"},"modified":"2026-09-25T01:23:57","modified_gmt":"2026-09-25T01:23:57","slug":"lightning-labs-discloses-critical-bug-marking-canceled-invoices-paid-risking-free-product-delivery","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=13692","title":{"rendered":"Lightning Labs discloses critical bug marking canceled invoices paid, risking free product delivery"},"content":{"rendered":"<p><\/p>\n<div data-cs-editorial-figure-scope=\"\" data-cs-editorial-quote-scope=\"\" data-cs-image-viewer-scope=\"\" data-single-article-content=\"\">\n<p>A flaw in older Lightning Terminal software could mark a Bitcoin Lightning invoice paid after the payment was cancelled and returned to its sender, Lightning Labs disclosed on Sept. 21, 2026.<\/p>\n<p>A merchant relying on that invoice status could release goods or credit without receiving funds. The company describes that risk but gives no tally of actual merchant losses.<\/p>\n<p>The issue was a mismatch between the software&#8217;s invoice record and the payment&#8217;s outcome. A Lightning payment uses a hashed time-locked contract (HTLC) to carry funds.<\/p>\n<p>In this case, the HTLC was canceled on the network and returned to the sender, while the receiving node still recorded the invoice as settled. The advisory does not describe a failure of Bitcoin&#8217;s base chain.<\/p>\n<p>Lightning Terminal bundles tapd, software for Taproot Assets, with the lnd Lightning node. In the affected setup, tapd enabled its invoice interceptor and treated any HTLC carrying custom wire records as an asset payment.<\/p>\n<p>Some sender implementations added an experimental endorsement record even to ordinary BTC payments, causing tapd&#8217;s strict-forwarding rule to instruct lnd to cancel the HTLC set. The trigger did not require the merchant to have any open asset channels.<\/p>\n<figure id=\"attachment_565506\" aria-describedby=\"caption-attachment-565506\" style=\"width: 720px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" loading=\"lazy\" decoding=\"async\" class=\"wp-image-565506\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-b104b93c-2d0f-438e-ba80-36cd0f2f9f7d.png\" alt=\"Diagram showing an ordinary BTC payment with a custom record, tapd cancellation, payment returned to sender, an invoice marked settled, and the 2025 tapd and lnd fixes.\" width=\"720\" height=\"900\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-b104b93c-2d0f-438e-ba80-36cd0f2f9f7d.png 1122w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-b104b93c-2d0f-438e-ba80-36cd0f2f9f7d-240x300.png 240w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-b104b93c-2d0f-438e-ba80-36cd0f2f9f7d-819x1024.png 819w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-b104b93c-2d0f-438e-ba80-36cd0f2f9f7d-768x960.png 768w\" sizes=\"auto, (max-width: 720px) 100vw, 720px\"\/><img loading=\"lazy\" loading=\"lazy\" decoding=\"async\" class=\"lazyload wp-image-565506\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-b104b93c-2d0f-438e-ba80-36cd0f2f9f7d.png\" alt=\"Diagram showing an ordinary BTC payment with a custom record, tapd cancellation, payment returned to sender, an invoice marked settled, and the 2025 tapd and lnd fixes.\" width=\"720\" height=\"900\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-b104b93c-2d0f-438e-ba80-36cd0f2f9f7d.png 1122w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-b104b93c-2d0f-438e-ba80-36cd0f2f9f7d-240x300.png 240w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-b104b93c-2d0f-438e-ba80-36cd0f2f9f7d-819x1024.png 819w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-b104b93c-2d0f-438e-ba80-36cd0f2f9f7d-768x960.png 768w\" data-sizes=\"(max-width: 720px) 100vw, 720px\"\/><figcaption id=\"caption-attachment-565506\" class=\"wp-caption-text\">Lightning Labs patched a flaw where canceled Bitcoin payments could still appear settled on merchant invoices, risking goods or credit without payment.<\/figcaption><\/figure>\n<p>The second defect sat in lnd. When an interceptor canceled the HTLC set, affected versions canceled the payment on the wire but still marked its invoice as settled in the database.<\/p>\n<aside id=\"cs-inline-newsletter-1\" class=\"cs-inline-newsletter\" data-inline-newsletter=\"\" data-newsletter-placement=\"article-midpoint\" data-newsletter-pending-label=\"Joining\u2026\" data-newsletter-pending-status=\"Joining The Catalyst\u2026\" data-newsletter-email-required-message=\"Before sending, please provide your email address.\" aria-labelledby=\"cs-inline-newsletter-1-title\" aria-describedby=\"cs-inline-newsletter-1-copy\">\n<div class=\"cs-inline-newsletter__inner\">\n<div class=\"cs-inline-newsletter__content\"> <span class=\"cs-inline-newsletter__eyebrow\"> <i class=\"fa-regular fa-envelope\" aria-hidden=\"true\"\/> The Catalyst <\/span><\/p>\n<h2 id=\"cs-inline-newsletter-1-title\" class=\"cs-inline-newsletter__title\">What\u2019s moving crypto. Why it matters.<\/h2>\n<p id=\"cs-inline-newsletter-1-copy\" class=\"cs-inline-newsletter__copy\">Get CryptoSlate\u2019s essential stories and what to watch next.<\/p>\n<p>  <svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"16\" fill=\"currentColor\" viewbox=\"0 0 16 16\" aria-hidden=\"true\" focusable=\"false\"> <path d=\"M15 3.604H1v1.891h14v-1.89ZM1 7.208V16l7-3.926L15 16V7.208zM15 0H1v1.89h14z\"\/> <\/svg> <span>Published on Substack<\/span> <\/div>\n<div class=\"cs-inline-newsletter__form-shell\">\n<p id=\"cs-inline-newsletter-1-privacy\" class=\"cs-inline-newsletter__privacy\">Seven days a week. Unsubscribe anytime.<\/p>\n<p> <i class=\"fa-regular fa-circle-xmark\" aria-hidden=\"true\"\/> <span>Whoops, looks like there was a problem. Please try again.<\/span><\/p>\n<div class=\"cs-inline-newsletter__success\" role=\"status\" aria-live=\"polite\" aria-atomic=\"true\" tabindex=\"-1\"> <span class=\"cs-inline-newsletter__success-icon\" aria-hidden=\"true\"\/><\/p>\n<div>\n<h3 class=\"cs-inline-newsletter__success-title\">Check your inbox.<\/h3>\n<p class=\"cs-inline-newsletter__success-copy\">Your signup request was sent. If confirmation is required, follow the email from Substack.<\/p>\n<p class=\"cs-inline-newsletter__success-hint\">Look in spam or promotions if you don\u2019t see it.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/aside>\n<p>That meant the error stood in another client of lnd&#8217;s <code>HtlcModifier<\/code> interface that canceled an HTLC set could produce the same mismatch. Lightning Labs rates the vulnerability high severity because a false paid status could lead an operator or payment service to release value against a payment that never completed. According to the advisory, the sender&#8217;s funds were not at risk.<\/p>\n<div class=\"cs-article-embed\">\n<p> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">Malicious bots are actively probing exposed Bitcoin payment servers to steal master administrative keys<\/h3>\n<\/p>\n<p> <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\"> <i class=\"fa-light fa-arrow-up-right\"\/> <\/span> <\/div>\n<h2>Fixes shipped before disclosure<\/h2>\n<p>Lightning Terminal v0.15.0-alpha bundles fixes for both defects. Lightning Labs lists earlier Terminal versions as affected, along with taproot assets through v0.5.0 and lnd 0.18.4-beta through 0.18.5-beta.<\/p>\n<p>The tapd trigger was fixed in v0.5.1 on Feb. 12, 2025. Terminal v0.14.1-alpha included that fix, but its bundled lnd version still had the underlying invoice-state defect.<\/p>\n<p>lnd v0.19.0-beta fixed the accounting error on May 22, 2025. The September 2026 advisory therefore disclosed a vulnerability whose relevant fixes had shipped in 2025. For Terminal operators who cannot update and have no asset channels, Lightning Labs identifies <code>--taproot-assets-mode=disable<\/code> as a way to avoid the observed tapd trigger.<\/p>\n<\/div>\n<p>Adoption,Featured,Layer-2,Payments,Bitcoin,paymentsBitcoin,payments#Lightning #Labs #discloses #critical #bug #marking #canceled #invoices #paid #risking #free #product #delivery1790299437<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A flaw in older Lightning Terminal software could mark a Bitcoin Lightning invoice paid after the payment was cancelled and returned to its sender, Lightning Labs disclosed on Sept. 21, 2026. A merchant relying on that invoice status could release goods or credit without receiving funds. The company describes that risk but gives no tally<\/p>\n","protected":false},"author":1,"featured_media":13693,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[91,4425,1132,158,7115,7101,2111,7114,240,2661,235,1743,167,58,4464],"class_list":["post-13692","post","type-post","status-publish","format-standard","has-post-thumbnail","category-ethereum","tag-bitcoin","tag-bug","tag-canceled","tag-critical","tag-delivery","tag-discloses","tag-free","tag-invoices","tag-labs","tag-lightning","tag-marking","tag-paid","tag-payments","tag-product","tag-risking"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.6 (Yoast SEO v26.6) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Lightning Labs discloses critical bug marking canceled invoices paid, risking free product delivery - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"description\" content=\"Older Lightning Terminal versions could mark canceled Bitcoin payments as paid, putting merchants at risk of releasing value without receiving funds.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=13692\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Lightning Labs discloses critical bug marking canceled invoices paid, risking free product delivery\" \/>\n<meta property=\"og:description\" content=\"Older Lightning Terminal versions could mark canceled Bitcoin payments as paid, putting merchants at risk of releasing value without receiving funds.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=13692\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-25T01:23:57+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/crypto-route-signs.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=13692\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=13692\",\"name\":\"Lightning Labs discloses critical bug marking canceled invoices paid, risking free product delivery - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=13692#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=13692#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/crypto-route-signs.webp\",\"datePublished\":\"2026-09-25T01:23:57+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"description\":\"Older Lightning Terminal versions could mark canceled Bitcoin payments as paid, putting merchants at risk of releasing value without receiving funds.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=13692#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=13692\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=13692#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/crypto-route-signs.webp\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/crypto-route-signs.webp\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=13692#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Lightning Labs discloses critical bug marking canceled invoices paid, risking free product delivery\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto &amp; Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Lightning Labs discloses critical bug marking canceled invoices paid, risking free product delivery - Crypto News: Latest Cryptocurrency News and Analysis","description":"Older Lightning Terminal versions could mark canceled Bitcoin payments as paid, putting merchants at risk of releasing value without receiving funds.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=13692","og_locale":"en_US","og_type":"article","og_title":"Lightning Labs discloses critical bug marking canceled invoices paid, risking free product delivery","og_description":"Older Lightning Terminal versions could mark canceled Bitcoin payments as paid, putting merchants at risk of releasing value without receiving funds.","og_url":"https:\/\/cryptonews.uk.com\/?p=13692","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-09-25T01:23:57+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/crypto-route-signs.webp","type":"image\/webp"}],"author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=13692","url":"https:\/\/cryptonews.uk.com\/?p=13692","name":"Lightning Labs discloses critical bug marking canceled invoices paid, risking free product delivery - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=13692#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=13692#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/crypto-route-signs.webp","datePublished":"2026-09-25T01:23:57+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"description":"Older Lightning Terminal versions could mark canceled Bitcoin payments as paid, putting merchants at risk of releasing value without receiving funds.","breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=13692#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=13692"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=13692#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/crypto-route-signs.webp","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/crypto-route-signs.webp","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=13692#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"Lightning Labs discloses critical bug marking canceled invoices paid, risking free product delivery"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto &amp; Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/13692","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=13692"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/13692\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/13693"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=13692"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=13692"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=13692"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}