Lightning tightens invoice rules after reported attack made Bitcoin withdrawals look unpaid

Lightning developers tightened BOLT11, the Lightning Network’s invoice standard, on Oct. 19 to require software to reject ambiguous payment-hash and payment-secret fields. The change follows a developer’s account of an attack that made completed Bitcoin withdrawals appear unpaid. The merged change targets software components reading the same signed payment request differently. A payment hash identifies the payment a component is tracking. Bitcoin Optech highlighted the rule change on Oct. 23. In practical terms, a service could track a withdrawal under one hash while its node executes a payment using another.