Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it
The main Electrum server the client connects to is trusted with mempool ("unconfirmed") transactions. This is documented design. [0] However now someone figured out a way to practically exploit it: when the client broadcasts a new tx1, a malicious server can swallow it, and update the client's history with a conflicting (invalid) tx2 that replaces the outputs with the attacker's output address. Tx2 has invalid signatures, but this is not …