Threats affecting pkg:github/spesmilo/electrum

Electrum versions before 4.7.2 have a critical TOCTOU race condition vulnerability in the Nostr Wallet Connect plugin. This flaw allows malicious clients to bypass the daily spending limit by exploiting non-atomic budget checks and truncation of millisatoshi amounts. Attackers can send concurrent payment requests or repeatedly pay amounts that are rounded down, enabling them to drain funds beyond the intended limit.

Electrum versions before 4.8.3 have a vulnerability where the software fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions. This flaw allows malicious servers to replace a user's just-broadcast transaction with a conflicting transaction that appears to have zero fees and pays an attacker address. Users can be tricked into performing Replace-By-Fee (RBF) fee-bumping on this invalid transaction, effectively losing funds to the attacker. The issue is fixed in Electrum version 4.8.3.