1/ Tomorrow it's been a month since we shut down @lnp2pBot. I finished the forensics and I don't love what I found. The bug they used wasn't in our code. It was in a dependency. And the fix had been out for 3 days already.
2/ The library is `invoices`, the BOLT11 parser half the Lightning JS ecosystem depends on. If a payment request had the payment hash twice, the parser kept the last one. The node uses the first one. Same string, two parts of the same system, two different IDs.
3/ In plain terms: the attacker sent us an invoice our bot and our node read differently, and got paid twice for the same thing. The bot was tracking one payment. The node had settled another. Every round they ran, we ate the difference.
4/ That line had been there for 2,381 days. It went in with the very first commit of the repo, back in January 2020. There was never a version of the library without it.
5/ It got fixed on August 7, and it was pushed down to `lightning` and `ln-service` the same day. I want to say that up front, because it's true and it matters: the fix itself was fast and handled well.
6/ What went wrong was the announcement. Here is the entire changelog entry for that release:
"Breaking Changes , Node.js version 22 or higher is now required"
Not a word about the payment hash. No advisory. No CVE.
7/ Now put yourself downstream. A major version lands and it wants you to go from Node 20 to Node 22. You read that as chores. You put it on the list for when things calm down. The only signal you had was pushing you to wait.
8/ This is the part I want to change, and it isn't about one person: a security fix can't ride along inside a breaking infra change. It has to say so out loud. An advisory, a line in the changelog, a ping to the people who depend on you.
9/ Without that, reading changelogs doesn't save you. We had no way to know we were supposed to run. We found out 3 days late, with the bot already closed and the losses on us.
10/ What we're building on Mostro now: event-driven watching on the dependencies that matter. New version drops, an agent diffs it right then, and answers one question, does this quietly fix something security related?
Against a 3 day window, a weekly check has already lost.
11/ A month later I'm still going through it. Full story at @LaBitconf
GitHub
use first payment hash and require node v22 · alexbosworth/invoices@b30a012
Library for parsing Lightning Network BOLT11 payment requests and encoding invoices into requests - use first payment hash and require node v22 · ...
