Closed
Description
Anyone can create a blinded path to us with whatever data they want in it, including the Bolt12OfferContext
. While they have to have a payment_secret
that matches the amount we expected to receive, this may be extracted from a BOLT 11 invoice. Then someone can forge a payment for an OfferId
even if it doesn't match the amount we expected for that offer.