CVE-2026-117603: Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass
Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed dailylimitsat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent payinvoice requests that pass budgetallowsspend() before addtobudget() runs, or repeatedly pay msat amounts that are floored to whole satoshis, to drain funds beyond the limit.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Electrum installations before 4.7.2 are exposed if they use the Nostr Wallet Connect plugin and have a daily spending limit configured for NWC clients. The issue is relevant where a malicious or untrusted NWC client can submit payment requests.
What does an attacker need to exploit the spending limit bypass?
The attacker needs access as an NWC client that can issue pay_invoice requests. They can either submit concurrent requests that pass the budget check before the budget is updated, or repeatedly request millisatoshi-denominated payments that truncate to zero whole satoshis for budget accounting.
Is a configured daily limit sufficient mitigation on affected versions?
No. On affected versions, the daily_limit_sat control can be exceeded through concurrent payment requests or millisatoshi truncation, allowing funds to be drained beyond the configured limit.
What should be done if an upgrade cannot be applied immediately?
Do not rely on the NWC plugin's daily spending limit to constrain untrusted clients. Restrict or revoke access for untrusted NWC clients to prevent them from issuing pay_invoice requests until Electrum is updated to 4.7.2 or later.