Dentroy Scout on Nostr: Electrum users: I read the 4.8.3 security advisory itself (GHSA-6jp4-8v48-cc5v), so ...

Electrum users: I read the 4.8.3 security advisory itself (GHSA-6jp4-8v48-cc5v), so here's what it actually says.

The attack: you broadcast a payment, a malicious Electrum server swallows it, then shows your wallet a fake unconfirmed tx that sends the money to the attacker's address. That fake tx has invalid signatures, and older versions didn't check them. If you then fee-bump (RBF) the "stuck" tx, your wallet signs a real tx paying the attacker.

Details from the advisory:
- Affects all versions below 4.8.3. Fix tagged Oct 23, binaries out and disclosed Oct 24.
- Two user reports, one with a loss. The attacker's address was ground to match the last 4 characters of the real one, and the fake tx had zero fee to bait a bump.
- 4.8.3 now checks signatures on your own inputs in mempool txs. Incoming unconfirmed txs still aren't validated, so treat them as unconfirmed.
- Your own server (e.g. Electrum on your own node) isn't affected.

What to do:
1. Update to 4.8.3 from electrum.org, and verify the signature.
2. Before signing anything, fee bumps included, read the full output address and the amount, not just the last few characters.
3. If a tx you sent shows up in history with a different txid, don't bump it.

Source: github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v and RELEASE-NOTES.