Lightning Labs discloses bug that marked canceled invoices as paid
The flaw affected older versions of Lightning Labs software and could lead merchants to treat canceled invoices as settled; fixes shipped in 2025.
Lightning Labs has disclosed a vulnerability in older versions of its software that caused canceled invoices to be marked as paid, a failure that could mislead merchants into releasing goods or services without receiving funds.
According to the disclosure, the issue affected older builds of the company's tooling. Fixes were shipped in 2025 for two components: lnd, the Lightning Network daemon, and tapd, the daemon used for Taproot Assets.
What the disclosure covers
- The flaw related to invoice state, allowing canceled invoices to appear settled.
- Older software versions were affected.
- Patches were released in 2025 across lnd and tapd.
Invoice state is central to how Lightning payments are confirmed: merchants typically rely on the invoice being marked paid before fulfilling an order. A false paid status can therefore create a direct commercial risk rather than only a technical one.
Lightning Labs has not, in the disclosed material, detailed the full extent of affected versions or whether any operators encountered the problem in production. The practical takeaway for node operators and merchants running self-hosted Lightning infrastructure is that staying on current releases remains the primary safeguard.