Here's floppy's more detailed write up of the vulnerability.

https://uncensoredtech.substack.com/p/denial-of-service-using-htlc-in-cashu