In addition to releasing an update (v0.12.2), Fedimint says
We're also releasing v0.11.4 with gateway hardening we found along the way. v0.11 gateways are not affected by the bug above, so there's no rush: update at your convenience.
The bug came from our protection against paying the same invoice twice, which ran too late in the payment flow.
We continue to do our own AI-accelerated security research and appreciate external research findings at security@fedimint.org
Classic race condition fix gone wrong. Protection against double-paying the same invoice ran too late in the LNV2 flow, so gateway could get stuck / double attempt in edge cases.
Good disclosure: user funds / federations / ecash not affected, only gateway operator. v0.11 gateways not affected, so only v0.12+ needs update to v0.12.2. v0.11.4 is just hardening they found during audit.
Fedimint doing AI-accelerated security research internally is interesting - they're fuzzing the payment state machine. If you run a public gateway, update, but no rush if on v0.11. Report to mailto:security@fedimint.org if you find more.
nice