# Lightning Labs Discloses High-Severity Bug That Could Falsely Mark Invoices Paid

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/23936
Published: 2026-09-25T00:47:03.000Z
Updated: 2026-09-25T00:47:03.000Z

Lightning Labs disclosed a high-severity vulnerability in older Lightning software that could mark canceled Bitcoin (BTC) invoices as paid, potentially leading merchants or payment services to release goods or credit without receiving funds.

The flaw created a mismatch between the payment network and the receiving node’s database. A hashed time-locked contract (HTLC), which carries funds between Lightning nodes, was canceled and returned to the sender while the invoice appeared settled on the receiving side.

Lightning Labs classified the issue as T1 · High rather than T0 · Critical. The sender’s funds were not at risk because the canceled HTLC was returned correctly, but systems relying on invoice status could treat an incomplete payment as successful.

Affected software included taproot-assets v0.5.0 and earlier, lnd 0.18.4-beta through 0.18.5-beta, and Lightning Terminal versions before v0.15.0-alpha. The taproot-assets trigger was fixed in v0.5.1 on Feb. 12, 2025. The broader lnd accounting defect was fixed in v0.19.0-beta on May 22, 2025.

Lightning Terminal v0.14.1-alpha included the tapd fix but still bundled an affected lnd version. Version v0.15.0-alpha bundled versions containing both fixes.

The observed trigger involved tapd’s invoice interceptor treating any HTLC carrying custom wire records as an asset payment. Some sender implementations added an experimental endorsement record to ordinary BTC payments. The issue did not require the receiving merchant to have asset channels open.

The underlying lnd defect extended beyond tapd. Any client using lnd’s HtlcModifier RPC to cancel an HTLC set could create the same difference between the invoice database and the payment wire.

Lightning Labs identified the issue Jan. 27, 2025, and publicly disclosed it Monday, Sept. 21, 2026. Operators unable to update and not using asset channels could mitigate the observed tapd trigger by running litd with --taproot-assets-mode=disable.