Lightning builders tightened BOLT11, the Lightning Community’s bill commonplace, on Oct. 19 to require software program to reject ambiguous payment-hash and payment-secret fields. The change follows a developer’s account of an assault that made accomplished Bitcoin withdrawals seem unpaid.
The merged change targets software program parts studying the identical signed cost request in a different way. A cost hash identifies the cost a part is monitoring. Bitcoin Optech highlighted the rule change on Oct. 23.
In a Sept. 10 assertion on the proposal, developer Roasbeef reported a current hack of a Telegram peer-to-peer bot that exploited libraries selecting totally different hashes: some took the primary payment-hash discipline in an bill, whereas others took the final. He gave no incident date or loss determine.
In sensible phrases, a service may monitor a withdrawal underneath one hash whereas its node executes a cost utilizing one other. The service may then mistake the finished withdrawal for an unpaid one, creating a gap for additional payouts. The failure sits within the connection between cost execution and the service’s accounting.
What readers should reject
The present BOLT11 specification requires precisely one payment-hash discipline, labeled p, and precisely one payment-secret discipline, labeled s. A lacking discipline or a second incidence requires cost failure. The rule covers each sorts of ambiguity, whereas the described withdrawal assault involved conflicting cost hashes.
Readers should rely discipline occurrences. The proposal’s invalid check instances embody an bill repeating the identical hash, in addition to one containing distinct hashes. Collapsing equivalent values right into a single worth would due to this fact miss an bill the rule requires readers to reject.
The implementation timeline additionally issues. The Lightning node software program lnd merged duplicate-hash rejection on Sept. 23, earlier than the specification change. Its out there v0.20.5-beta and v0.21.4-beta releases embody that payment-hash repair.
The broader payment-secret checks are addressed by a separate lnd proposal that remained open as of Oct. 27. It could tighten payment-secret and different decoder checks, together with rejecting a second s discipline. The creator additionally explains that some invoices accepted by the decoder already face checks later in cost processing, so decoding success alone doesn’t set up {that a} cost will undergo.
For cost operators, the documented failure factors to 2 checks: reject ambiguous invoices and guarantee withdrawal accounting follows the identical cost hash because the node.
