Lightning Labs discloses critical bug marking canceled invoices as paid

By Khal · · 1 min read

Editorial illustration: A blue arrow carrying a lightning-marked coin curves toward an open wallet. Beside it, a dark terminal holds a card with a green check mark next to a parcel on a conveyor.
AI-generated editorial illustration · AI-generated editorial illustration · Published Sep 25, 2026, 1:06 a.m. (56 minutes ago)

In brief

  • Lightning Terminal bug marked invoices paid after payments were cancelled and returned to senders
  • Merchants risked releasing goods without receiving funds due to false paid status
  • Fixes shipped in 2025 via Terminal v0.15.0-alpha, patching both tapd and lnd defects
  • Sender funds were not at risk, according to Lightning Labs advisory

The flaw

A flaw in older Lightning Terminal software could mark a Bitcoin Lightning invoice paid after the payment was cancelled. The issue was a mismatch between the software's invoice record and the payment's outcome.

When an interceptor canceled the HTLC set, affected versions canceled the payment on the wire but still marked its invoice as settled in the database. The HTLC was canceled on the network and returned to the sender, while the receiving node still recorded the invoice as settled. A merchant relying on that false status could release goods or credit without receiving funds.

How it happened

Lightning Terminal bundles tapd software for Taproot Assets with the lnd Lightning node. Some sender implementations added an experimental endorsement record even to ordinary BTC payments, causing tapd's strict-forwarding rule to instruct lnd to cancel the HTLC set.

The trigger was tapd-side; the underlying defect was in lnd's invoice accounting. Both needed fixing.

Severity and impact

Lightning Labs rates the vulnerability high severity because a false paid status could lead an operator or payment service to release value against a payment that never completed. According to the advisory, the sender's funds were not at risk.

Timeline and fixes

The tapd trigger was fixed in v0.5.1 on February 12, 2025. lnd v0.19.0-beta fixed the accounting error on May 22, 2025. Lightning Terminal v0.15.0-alpha bundles fixes for both defects.

Earlier Terminal versions, taproot assets through v0.5.0, and lnd 0.18.4-beta through 0.18.5-beta were listed as affected. Terminal v0.14.1-alpha included the tapd fix, but its bundled lnd version still had the underlying invoice-state defect.

For Terminal operators who cannot update and have no asset channels, Lightning Labs identifies --taproot-assets-mode=disable as a way to avoid the observed tapd trigger.

Related stories