The terms: lightNing inVOICE RUles aSTER ATTACK MADE PAID WithDRAWALS LOOK UNPAID Lightning developers reduced the invoice standard of BOLT11 after a real-world attack revealed a dangerous crippling problem. The issue involved invoices containing payment-fire fields. Different pieces of software can interpret the same signed invoice differently. One system may track the first payment. Another one can use last. According to a developer's account, this incompatibility was exploited against a peer-to-peer Telegram bot. Withdrawal can be paid successfully on the lightning while the accounting system of the service believed that the payment failed. This can create an opportunity to request additional payment. The updated BOLT11 rules now require invoices to contain exactly: • One payment - payment secret missing or duplicate fields should be rejected. The LND lightning application has already shipped hash-paid protection in recent releases, while more dark tests are still being developed. Important: This was not a Bitcoin base attack. Bitcoin and Consensus transactions were not affected. The problem was how the Lightning applications interpreted invoice data and settled payments. The lesson is broader than one bug. As Bitcoin's payment infrastructure becomes more complex, different pieces of software must agree on more than just the money. But what exactly does the payment request mean? @BitcoinNews.

The terms: lightNing inVOICE RUles aSTER ATTACK MADE PAID WithDRAWALS LOOK UNPAID Lightning developers reduced the invoice standard of BOLT11 after a real-world attack revealed a dangerous crippling problem. The issue involved invoices containing payment-fire fields. Different pieces of software can interpret the same signed invoice differently. One system may track the first payment. Another one can use last. According to a developer's account, this incompatibility was exploited against a peer-to-peer Telegram bot. Withdrawal can be paid successfully on the lightning while the accounting system of the service believed that the payment failed. This can create an opportunity to request additional payment. The updated BOLT11 rules now require invoices to contain exactly: • One payment - payment secret missing or duplicate fields should be rejected. The LND lightning application has already shipped hash-paid protection in recent releases, while more dark tests are still being developed. Important: This was not a Bitcoin base attack. Bitcoin and Consensus transactions were not affected. The problem was how the Lightning applications interpreted invoice data and settled payments. The lesson is broader than one bug. As Bitcoin's payment infrastructure becomes more complex, different pieces of software must agree on more than just the money. But what exactly does the payment request mean? @BitcoinNews.