GHSA-q7m2-785w-r585: Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass
Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed dailylimitsat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent payinvoice requests that pass budgetallowsspend() before addtobudget() runs, or repeatedly pay msat amounts that are floored to whole satoshis, to drain funds beyond the limit.
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
A malicious Nostr Wallet Connect client can exploit it by sending pay_invoice requests. No privileges or user interaction are required according to the supplied severity vector.
Are installations using the Nostr Wallet Connect plugin affected by default?
The issue is specifically in the Nostr Wallet Connect plugin. The provided data does not establish whether that plugin is enabled by default, but Electrum versions before 4.7.2 are affected when the plugin is in use.
What attack techniques bypass the configured daily spending limit?
An attacker can submit concurrent pay_invoice requests so multiple requests pass budget_allows_spend() before add_to_budget() updates the budget. They can also repeatedly pay millisatoshi-denominated amounts that are truncated down to whole satoshis when accounting for the limit.
What is the practical impact of successful exploitation?
The attacker can spend beyond daily_limit_sat and drain funds beyond the intended daily limit. The supplied vector rates confidentiality, integrity, and availability impact as high.