Bug in Lightning Terminal could mark canceled invoices as paid

Lightning Labs issued an advisory on Sept. 21, 2026 saying a bug in older Lightning Terminal software could mark canceled Bitcoin Lightning invoices as paid. Merchants and payment services that rely on invoice status could release goods, services or store credit without receiving funds.

The problem involved a mismatch between an invoice record in a node’s database and the actual outcome of the payment on the Lightning network. Lightning payments use hashed time-locked contracts (HTLCs) to route funds. In the reported cases the HTLC was canceled on the network and the funds returned to the sender, while the receiving node nevertheless recorded the invoice as settled.

Lightning Terminal bundles tapd, software for Taproot Assets, with the lnd Lightning node. One trigger came from tapd’s invoice interceptor combined with a strict-forwarding rule that treated HTLCs carrying certain custom wire records as asset payments. Some sender implementations began including an experimental endorsement record on ordinary bitcoin payments. When tapd detected that record it instructed lnd to cancel the HTLC set, and the cancellation could occur even when the merchant had no open asset channels.

A separate accounting defect in lnd caused a canceled HTLC set to be removed from the wire while the corresponding invoice remained marked as paid in the node’s database. Lightning Labs’ advisory noted that another client of lnd’s HtlcModifier interface could produce the same invoice-state mismatch.

Lightning Labs rated the vulnerability high severity because a false paid status could prompt an operator, point-of-sale system or payment service to release value against a payment that never completed. The advisory states that sender funds were not at risk. The company did not provide a tally of any actual merchant losses and warned that installations still running affected releases remain exposed.

Fixes for the two defects were released in 2025. The tapd trigger was fixed in taproot-assets v0.5.1 on Feb. 12, 2025. Terminal v0.14.1-alpha included that tapd fix but bundled an older lnd that still exhibited the invoice-state error. lnd v0.19.0-beta addressed the accounting bug on May 22, 2025. Lightning Terminal v0.15.0-alpha bundles both fixes. Lightning Labs lists earlier Terminal versions as affected, along with taproot-assets through v0.5.0 and lnd 0.18.4-beta through 0.18.5-beta.

For operators who cannot update and do not use asset channels, the advisory recommends running Terminal with –taproot-assets-mode=disable to avoid the observed tapd trigger. The advisory urges merchants, payment processors and node operators using the listed older releases to update to the patched versions or apply the workaround to prevent invoice-state mismatches.