LND Pending Commitment Excessive HTLC Failback Exploit

Impact

An attacker with a direct channel to a victim lnd node could steal the value of one or more in-flight HTLCs by combining an available denial-of-service vector with a race condition in lnd’s handling of pending commitment transactions.

A channel peer can hold two valid commitment transactions at a time: a to-be-revoked commitment and a pending commitment. When the remote party’s pending commitment confirms, lnd fails back all HTLCs that were present on the to-be-revoked commitment but are absent from the pending commitment, on the assumption that those HTLCs’ outcomes have already been forwarded upstream. Under normal conditions this is safe. The race condition arises when the victim node is crashed at a precise moment — after the preimage for an outgoing HTLC becomes known but before that result has propagated to the upstream node. An attacker who controls both the crash timing (using an available unpatched DoS vector) and the confirming commitment can then claim the outgoing HTLC via the preimage path while the victim’s node, upon restart, fails back the incoming HTLC — capturing the value from both ends.

The attack requires the attacker to have at least one direct channel with the victim and access to an unpatched denial-of-service vector to control crash timing. Under those conditions it can be carried out in 10–20 minutes.

Severity

Scored against the Lightning Labs severity taxonomy (4-dimension rubric):

Dimension	Score	Reasoning
Impact	Med	Per-victim fund loss; the value of one or more HTLCs can be stolen.
Attack Vector	Med	Channel partner. The attacker must have at least one direct channel with the victim and be able to route HTLCs through it.
Exploitability	Med	Requires specific conditions — a direct channel and an available DoS vector to control crash timing — but is reliably executable when those conditions are met. Without a DoS vector the race window is extremely narrow and very unlikely to trigger in practice.
Virality	Low	Per-victim. Each attack requires dedicated channel setup and per-victim coordination; the technique does not propagate automatically.

Result: T1. Rule 2 (Impact = Med, base T1). No promotion (Vector ≠ High). No demotion (Exploitability ≠ Low; not both Vector and Virality are Low).

Patches

The issue was fixed in lnd v0.18.0-beta by lnd #8667 (“Merge new sweeper branch to master”), which brought lnd #8514 into master along with its isPreimageAvailable guard on the fail-back path (commit 6f0c2b5). The guard causes checkRemoteDiffActions to skip failing back an outgoing HTLC that is present on the to-be-revoked commitment but absent from the pending commitment when the preimage is already known, eliminating the race window. Users should update to v0.18.0-beta or later to be protected.

Disclosure timeline

• Reported to Lightning Labs by Matt Morehouse as part of a broader contractcourt and sweeper security audit.
• Fix merged and released in lnd v0.18.0-beta.
• Matt Morehouse requested public disclosure after the v0.19.0-beta release.
• Public disclosure: 2026-08-11.

Credit

Reported by Matt Morehouse.