Executive brief
LNbits is a Bitcoin Lightning Network wallet management system. When using an Eclair backend, the system incorrectly marks payments as failed if they don't settle within a 30-second timeout, even though the payment may still be processing. An attacker can exploit this by creating hold invoices and causing the system to incorrectly report payment failures while funds are simultaneously being settled, resulting in a total loss of funds for the node operator.
Technical details
The vulnerability is an improper exception handling issue (CWE-754) in the Eclair wallet backend integration. When LNbits makes blocking API calls to the Eclair node with a 30-second timeout, network delays or slow payment settlement can trigger an AskTimeoutException. The vulnerable code in eclair.py treats this timeout as a payment failure without checking the actual payment status, causing the system to mark in-flight payments as failed. An attacker can craft a hold invoice, trigger the timeout, and then settle the invoice after the system has already reported failure, leading to funds being settled outside of LNbits' tracking. The fix is to query the payment status after timeout errors rather than assuming failure. This vulnerability is patched in version 0.12.6 and affects all earlier versions.
Affected products
- LNbits LNbits <0.12.6
Timeline
- 2024-06-14: disclosed
- 2024-06-17: patched: Fixed in version 0.12.6