Vulnerability Disclosure For lnd Versions Below v0.14.0-beta

[Olaoluwa Osuntokun]

Hi y'all,

Earlier today a vulnerability in lnd versions older than 6 months (anything
below 0.14) was announced:
https://lists.linuxfoundation.org/pipermail/lightning-dev/2022-April/003561.html.
This issue also affected prior versions of c-lightning.

The issue prevented lnd from properly handling breach scenarios for anchor
transactions in certain cases (attacker using the new freedom given to HTLCs
within anchor channels). It's important to note that _without_ anchor
channels, a node is subject to mempool pinning related scenarios that may
lead to loss of funds.

For that that are unable to update for whatever reason, the following patch
can be applied to lnd v0.13.0 to resolve the issue:
```
diff --git a/breacharbiter.go b/breacharbiter.go
index 692cb8f36..703081073 100644
--- a/breacharbiter.go
+++ b/breacharbiter.go
@@ -309,20 +309,21 @@ func convertToSecondLevelRevoke(bo *breachedOutput, breachInfo *retributionInfo,
  // We'll also redirect the outpoint to this second level output, so the
  // spending transaction updates it inputs accordingly.
  spendingTx := spendDetails.SpendingTx
+ spendInputIndex := spendDetails.SpenderInputIndex
  oldOp := bo.outpoint
  bo.outpoint = wire.OutPoint{
  Hash:  spendingTx.TxHash(),
- Index: 0,
+ Index: spendInputIndex,
  }

  // Next, we need to update the amount so we can do fee estimation
  // properly, and also so we can generate a valid signature as we need
  // to know the new input value (the second level transactions shaves
  // off some funds to fees).
- newAmt := spendingTx.TxOut[0].Value
+ newAmt := spendingTx.TxOut[spendInputIndex].Value
  bo.amt = btcutil.Amount(newAmt)
  bo.signDesc.Output.Value = newAmt
- bo.signDesc.Output.PkScript = spendingTx.TxOut[0].PkScript
+ bo.signDesc.Output.PkScript = spendingTx.TxOut[spendInputIndex].PkScript

  // Finally, we'll need to adjust the witness program in the
  // SignDescriptor.
```

-- Laolu