There is a TODO for this in the code, but I am documenting this here as well since it is pretty important and allows to steal from a connector.
The connector accepts incoming transfers on paychans without checking if the channel is about to close. An attacker could 1) open a chan to the connector, 2) right away send a channel close tx, 3) wait until the settle delay is almost over and finally 4) send a transfer, which does leave the claim submitter with no time to send the claim.
Solution: If the channel watcher detects that a channel is about to close, he writes this info back into the DB. The middleware that handles incoming transfers could then read the channel details from the DB and reject incoming transfers on closing channels.
There is a TODO for this in the code, but I am documenting this here as well since it is pretty important and allows to steal from a connector.
The connector accepts incoming transfers on paychans without checking if the channel is about to close. An attacker could 1) open a chan to the connector, 2) right away send a channel close tx, 3) wait until the settle delay is almost over and finally 4) send a transfer, which does leave the claim submitter with no time to send the claim.
Solution: If the channel watcher detects that a channel is about to close, he writes this info back into the DB. The middleware that handles incoming transfers could then read the channel details from the DB and reject incoming transfers on closing channels.