Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it

Summary The main Electrum server the client connects to is trusted with mempool ("unconfirmed") transactions. This is documented design. [0] However now someone figured out a way to practically exploit it: - when the client broadcasts a new tx1, a malicious server can swallow it,

Source: GitHub Advisory Database