👉 CVE-2020-26895: LND Low-S Tx-Relay Standardness
Prior to v0.10.0-beta, a malicious peer could force an lnd node to accept a high-S ECDSA signature when updating new off-chain states. Though the signatures are valid according to consensus rules, the mempool policy would reject transactions containing high-S values, potentially leading to loss of funds if time-sensitive transactions cannot be relayed and confirmed. We have no evidence of the bug being exploited in the wild. It affects all classes of lnd nodes: routing, merchant, mobile, etc. The vulnerability was reported privately to the lnd team by Antoine Riard.
Summary: Lightning-dev