BTCPay Server has released version 2.4.2 to fix a critical vulnerability that let unauthenticated remote attackers access LND credential files. The issue was exploited to drain Lightning wallets belonging to merchants.
Frequently Asked Questions
Here is a list of frequently asked questions regarding the BTCPay Server patch for the critical LND vulnerability written in a natural userfriendly tone
General Background
Q I heard BTCPay Server released a patch for a critical bug in LND What is LND
A LND is the software that runs the Lightning Network part of your BTCPay Server It manages your payment channels and your Lightning wallets funds Think of it as the engine that lets you send and receive instant lowfee Bitcoin payments
Q What exactly was the vulnerability
A It was a critical security flaw in LND that could allow a malicious actor to trick your node into signing a transaction that gave them access to your Lightning wallet funds effectively draining your balance Its a type of transaction malleability attack
Q Is my money at risk if I havent updated yet
A Yes potentially If you are running an affected version of LND and your node is online your Lightning funds could be at risk You should update immediately to the patched version to secure your wallet
Q Does this affect my onchain Bitcoin wallet in BTCPay Server
A No This vulnerability is specific to the Lightning Network wallet Your regular onchain Bitcoin wallet is not affected by this particular bug but its always good practice to keep everything updated
Technical Actionable Questions
Q I use BTCPay Server How do I know if I am affected
A If you are using a version of LND older than the patched release you are affected The easiest way to check is to look at your BTCPay Server admin panel or run lnd version in your servers terminal If its older than 0175 you need to update
Q What is the exact version of LND I need to update to
A You need to update to LND v0175 or any newer version This specific release contains the fix for the critical vulnerability
Q Im not very technical How do I update my BTCPay Server