The Bitcoin Operations Technology Group (Optech) works to bring the best open source technologies and techniques to Bitcoin-using businesses in order to lower costs and improve customer experiences.
https://bitcoinops.org/
This week’s newsletter includes action items and news related to last week’s...
## Summary of Bitcoin Op Tech #14: The CVE Inflation Bug
This episode of the Bitcoin Op Tech newsletter and accompanying podcast focuses on a critical security vulnerability (CVE-2018-17144) discovered in Bitcoin Core, potentially allowing miners to inflate the Bitcoin supply. The bug, which affected versions 0.14 and above, stems from a flawed duplicate input check within the UTXO database structure. Exploiting this vulnerability involves a miner creating a transaction that spends the same Bitcoin output twice, leading to the creation of invalid coins and their addition to the UTXO database. While non-miners cannot exploit this bug, the potential for malicious actors to manipulate the supply was significant, with estimates suggesting up to 12.5 Bitcoin could have been created. To mitigate the risk, a rapid response was initiated, with the release of Bitcoin Core version 0.16.3 and release candidate 4, and a delayed public disclosure to allow for widespread upgrades. The episode emphasizes the importance of staying informed about Bitcoin security updates and highlights the value of the Bitcoin Op Tech newsletter for timely information.
1. Main Topics Discussed:
- Critical Security Release: Immediate need to upgrade to Bitcoin Core 0.16.3 or 0.17 release candidate 4.
- Inflation Vulnerability: Detailed explanation of how the bug allows for the creation of invalid Bitcoin.
- Technical Deep Dive: Analysis of the code changes in versions 0.14, 0.15, and 0.16 that led to the vulnerability and its exploitation.
- Disclosure Strategy: The rationale behind delaying public disclosure to facilitate rapid upgrades.
- UTXO Freshness & Manipulation: Explanation of how the UTXO database and its "freshness" status are exploited in the bug.
- UDP for Bitcoin P2P: Discussion of the potential benefits (low latency) and challenges (error correction, NAT traversal, congestion control) of using UDP instead of TCP for Bitcoin's peer-to-peer network.
- Wasabi Wallet Security: Addressing a question about how Wasabi wallet prevents malicious activity within its coin tumbling pool.
- Bitcoin Stack Exchange: Highlighted as a valuable resource for Bitcoin contributors.
2. Key Quotes:
- "This week's newsletter includes action items and news related to last week's security release..."
- "If you do not plan to upgrade or if you use an SPV client, you should consider waiting for more confirmations than you usually do." (Recommendation of 30 confirmations/5 hours)
- "Pierce, this is why you should be absolutely a subscriber to the Bitcoin Optek newsletter..."
3. People Mentioned:
- Peter Woolly: Developer
- Gregory Maxwell: Developer
- Vladimir Van der Laan: Developer
- Dettelnix: Developer
- SickPig: Developer
- Corey Fields: Developer
- Suha Mardur: Developer
- Alex Morcos: Developer
- Matt Carolo: Developer
- John Newberry: Developer
- James O'Bierne: Developer
- David Jansson: Developer
- Andrew Chow: Developer (provided detailed explanation of the bug)
- Luke Dash Jr.: Developer
- Avmany: Original reporter of the bug
- Hedge then Lead Verit: Asked the initial question regarding the vulnerability
4. Bitcoin Price if Mentioned:
- 12.5 Bitcoin (potential amount created by exploiting the bug)
- 1 Bitcoin (value of the output being manipulated)
The team plans to follow up with links to significant conclusions regarding the CVE bug and will discuss it further at the October 8th-10th Core Tech Tordef.Tech meetings.