Potential vulnerability in Lightning backends: BOLT-11 "payment hash" does not commit to payment!



Summary:

LNBits allows users to request and generate payments using BOLT11 invoices. It handles internal user-to-user payments by short-circuiting them instead of passing them through the LN implementation. However, this short-circuit version lacks certain checks specified in BOLT4. The writer suggests asking developers of underlying LN node implementations to support self-payment of their own invoices. This would eliminate the need for short circuit logic and simplify future protocol changes. Additionally, self-payment is a useful tool for experimentation with an API. The downside is that it may add complexity to LN implementations, but the benefits outweigh this concern.


Updated on: 2023-08-11T15:50:09.419516+00:00