A flaw in older Lightning Terminal software could mark a Bitcoin Lightning invoice paid after the payment was cancelled and returned to its sender, Lightning Labs disclosed on Sept. 21, 2026.
A merchant relying on that invoice status could release goods or credit without receiving funds. The company describes that risk but gives no tally of actual merchant losses.
The issue was a mismatch between the software’s invoice record and the payment’s outcome. A Lightning payment uses a hashed time-locked contract (HTLC) to carry funds.
In this case, the HTLC was canceled on the network and returned to the sender, while the receiving node still recorded the invoice as settled. The advisory does not describe a failure of Bitcoin’s base chain.
Lightning Terminal bundles tapd, software for Taproot Assets, with the lnd Lightning node. In the affected setup, tapd enabled its invoice interceptor and treated any HTLC carrying custom wire records as an asset payment.
Some sender implementations added an experimental endorsement record even to ordinary BTC payments, causing tapd’s strict-forwarding rule to instruct lnd to cancel the HTLC set. The trigger did not require the merchant to have any open asset channels.
The second defect sat in lnd. When an interceptor canceled the HTLC set, affected versions canceled the payment on the wire but still marked its invoice as settled in the database.
That meant the error stood in another client of lnd’s HtlcModifier interface that canceled an HTLC set could produce the same mismatch. Lightning Labs rates the vulnerability high severity because a false paid status could lead an operator or payment service to release value against a payment that never completed. According to the advisory, the sender’s funds were not at risk.
Fixes shipped before disclosure
Lightning Terminal v0.15.0-alpha bundles fixes for both defects. Lightning Labs lists earlier Terminal versions as affected, along with taproot assets through v0.5.0 and lnd 0.18.4-beta through 0.18.5-beta.
The tapd trigger was fixed in v0.5.1 on Feb. 12, 2025. Terminal v0.14.1-alpha included that fix, but its bundled lnd version still had the underlying invoice-state defect.
lnd v0.19.0-beta fixed the accounting error on May 22, 2025. The September 2026 advisory therefore disclosed a vulnerability whose relevant fixes had shipped in 2025. For Terminal operators who cannot update and have no asset channels, Lightning Labs identifies --taproot-assets-mode=disable as a way to avoid the observed tapd trigger.
The post Lightning Labs discloses critical bug marking canceled invoices paid, risking free product delivery appeared first on CryptoSlate.
