On October 19, the Lightning Network’s BOLT11 invoice standard was tightened to require exactly one payment hash and one payment secret in every invoice. Any invoice with a missing or repeated field must now be rejected. The change followed a developer’s account of an attack against a Telegram peer-to-peer bot, in which libraries interpreted multiple payment hashes differently and could mistake a completed withdrawal for an unpaid one. The lnd software merged duplicate-hash rejection on September 23 into versions v0.20.5-beta and v0.21.4-beta, while a separate proposal covering payment-secret checks remained open as of October 27. Operators must both reject ambiguous invoices and use the same payment hash when tracking and executing withdrawals.
Source: Read the original article
