The favored Bitcoin OpTech publication has created a Corridor of Fame to thank builders who responsibly disclosed main vulnerabilities in Bitcoin software program with out exploiting them for their very own profit. The record supplies greater than 4 years of historical past of episodes when Bitcoin got here near the brink of failing.
Bitcoin OpTech develops open-source applied sciences for companies fascinated with utilizing bitcoin. It routinely points accountable disclosures on software program vulnerabilities so builders can work on them. The agency is most well-known for its publication, a weekly electronic mail digest that covers technical information about Bitcoin and associated software program.
Now, it maintains a listing of a few of the largest bugs it has acquired studies on. A lot of them had been critical Bitcoin vulnerabilities that an attacker might have used to trigger important harm to necessary components of Bitcoin’s infrastructure, like Bitcoin Core or the Lightning Community.
Bitcoin vulnerabilities: Block parsing bug in LND and BTCD
Bitcoin Optech E-newsletter #222 reported a block parsing bug in LND and BTCD detected by Burak who goes by brqgoo. He despatched a 998-of-999 Taproot tapscript multi-signature transaction that broke a parsing library utilized by BTCD and LND. The bug was disclosed November 9, 2022.
Taproot’s consensus guidelines didn’t restrict the scale of witness information despatched in a transaction. Customers quickly reported that BTCD full node and LND Lightning Community implementations did not ahead information from latest blocks. A developer mounted the difficulty with a brand new model of BTCD’s code.
Learn extra: Bug freezes bitcoin inside Lightning Network for hours
Safety vulnerability detected in Lightning Community anchor outputs
Bastien Teinturier informed Lightning-Dev mailing record recipients a couple of safety subject affecting older variations of Core Lightning with experimental options and LND.
A more moderen design for LN anchor outputs allowed events to mix a number of revoked HTLC outputs right into a single transaction. This design included a flaw that would permit a celebration who issued a revoked HTLC to steal unclaimed funds when an HTLC timelock expired.
He had beforehand reported it to LN implementation maintainers and really useful that customers of outdated variations of Core Lightning set up upgrades. The bug was reported in Might 2021.
Cross-site scripting vulnerabilities in BTCPay Server
Ajmal Aboobacker and Abdul Muhaimin acquired disclosure bounties for informing BTCPay builders about three cross-site scripting vulnerabilities in BTCPay Server. BTCPay Server 1.2.3 mounted the difficulty. The bug was shared with the general public in September 2021.
Discrepancy between BIP125 and Bitcoin Core implementations
Earlier than that, Antoine Riard reported a doable supply of conflict between BIP125 and Bitcoin Core that was divulged in Might 2021. BIP125 allowed unconfirmed father or mother transactions that senders might substitute with Substitute-By-Charge to make any transactions utilizing the father or mother transactions’ output replaceable via inferred inheritance.
This function precipitated a battle with Bitcoin Core, which didn’t permit this habits. The battle might make an present LN vulnerability disclosed in Optech Newsletter #95 cheaper to take advantage of.
Acceptance of Non-Normal Signatures in LND
Antoine Riard disclosed a vulnerability in LND in October the identical yr, that precipitated it to simply accept transaction signatures that Bitcoin Core couldn’t relay or mine by default. When the transaction failed to verify on the Bitcoin Core degree, the timelock expired, and the attacker might steal the funds.
Stock out-of-memory Denial-of-Service assault
Again in September 2020, Braydon Fuller and Javed Khan revealed a vulnerability permitting attackers to flood bitcoin nodes with stock (inv) messages in a variation of the Denial-of-Service assault. Every inv message contained the utmost variety of transaction hashes.
When the goal nodes acquired too many inv messages, they might run out of reminiscence and crash. The Denial-of-Service assault may very well be mixed with an eclipse attack to steal funds.
LN payment ransom assault
In June 2020, René Pickhardt detected a Lightning Community vulnerability the place a sender might maintain funds hostage by not deciding on an acceptable payment charge when sending funds.
Even within the Lightning Community, attackers might drive up payment charges by sending a number of “junk” transactions, which might make the really useful payment construction increased than the chosen payment charge. Exploiting this vulnerability might pressure the recipient to shut the channel with out receiving funds or conform to settle the HTLCs offchain.
Charge overpayment assaults on multi-input segwit transactions
Greg Sanders discovered a vulnerability within the software program generally used to work together with {hardware} wallets in June 2020. {Hardware} wallets can present safe storage of digital property partly as a result of their house owners usually don’t depart them linked to a pc that connects to the Web.
Nevertheless, an attacker can hack a {hardware} pockets proprietor’s laptop and use it to grab management of the software program. The attacker can use that to trick the {hardware} pockets into overpaying for transaction charges by interfering with the algorithms used to calculate the UTXO quantities.
The vulnerability solely impacts stateless signers like {hardware} wallets that don’t retailer UTXO information and must recalculate it each time their house owners ship a transaction.
Overflow bug in reference C-language bech32 implementation
Trezor disclosed a bug within the reference operate for Bech32 implementations written within the C programming language in November 2018. The bug doesn’t have an effect on implementations written in different programming languages.
It launched a patch fixing the bug. Ledger knowledgeable Trezor a couple of comparable bug in one among Trezor’s libraries for Bitcoin Money addresses. Trezor additionally created a patch to repair it.
Bitcoin Optech mounted a denial-of-service vulnerability
The Bitcoin Optech workforce fixed a denial-of-service vulnerability that an attacker might have used to trick miners into accepting invalid bitcoin transactions. It really useful that miners and Bitcoin companies improve their software program to incorporate the repair or await at the least 30 confirmations.
Awemany initially reported the difficulty. Bitcoin Optech issued a warning about this vulnerability on September 20, 2018. In accordance with the technical particulars, the bug might have enabled the miner to arrange a exact set of circumstances through which a sender might spend bitcoin twice.
Cory Fields reported a consensus-breaking bug in Bitcoin Money
Cory Fields disclosed in August the identical yr that he made an nameless report of a consensus-breaking bug in Bitcoin Money after a irritating expertise with reporting the bug to Bitcoin Money builders.
He really useful making it simpler to report vulnerabilities to digital asset tasks anonymously. Neha Narula added some recommendations to undertaking maintainers for stopping doubtlessly catastrophic bugs.
Vulnerability in SPV proofs is publicly disclosed accidentally
A vulnerability in SPV proofs makes it doable to create an SPV proof of a non-existent transaction by creating an actual 64-bit transaction that tips miners into together with it in a block. Bitcoin creator Satoshi Nakamoto predicted this flaw in SPV proofs in Part 8 of the Bitcoin Whitepaper.
Builders believed that an attacker utilizing this exploit would discover it costlier than it’s value. To cowl their bases, although, they modified the Bitcoin Core RPCs to carry out further checks that may mitigate this vulnerability.
For extra knowledgeable information, observe us on Twitter and Google News or hearken to our investigative podcast Innovated: Blockchain City.
