Newest Bitcoin Bug Was So Wicked


This week main bitcoin bug was also worse than developers initially let on.

The bug initially shook the bitcoin world when reported the vulnerability could be used to shut down a chunk of the network.

While this sounded bad enough for many, it turns out developers for Bitcoin Core kept a second, more significant part of the bug a secret. As disclosed through an official Common Vulnerabilities and Exposures (CVE) report, an attacker could have used it to create new bitcoin – above the 21 million hard-cap of coin creation – thereby inflating the supply and devaluing current bitcoins.

Such a perversion of the rules would, at worst, according to many, make users not trust the cryptocurrency anymore.

Because of the disastrous implications of the bug, developers decided to keep it a secret, buying themselves time to fix the exploit and urge miners and users to upgrade their software.

The CVE report written by Bitcoin Core developers explains:



"Just to promote rapid upgrades, the decision was made to immediately patch and disclose the less serious denial of service vulnerability, concurrently with reaching out to miners, businesses and other affected systems, while delaying publication of the full issue to give time for systems to upgrade."


Presently, the plan seems to have worked.

Above half of bitcoin's mining hash rate has updated to the patched software version, indicating the attack can no longer use, and developers are "unaware of any efforts to exploit this vulnerability," the report states.

Finding such a severe bug was a stressful situation for developers to be cut in.

According to the article, an unidentified user originally filed a report about the denial-of-service bug to top developers of Bitcoin Core and Bitcoin ABC, the central software implementation of bitcoin cash. Nearly two hours later, Matt Corallo, a Chaincode engineer and Bitcoin Core developer realized the bug could have been exploited to print countless bitcoin.

Based on the importance of the vulnerability, the developers determined to keep those details hidden at first.

Instead, starting with Slush Pool, they began pushing miners to upgrade. And for bitcoin users operating a full node, the call to work is the same.

"You should not operate any version of Bitcoin Core other than 0.16.3. Older versions should not be on the network. Do you know anyone who is running an older version, tell them to upgrade it ASAP," Theymos bitcoin subreddit moderator remarked in a post currently pinned to the top of the forum.

A different problem exists now – the event of a bitcoin chain split.

Since users are now running several versions of the bitcoin software, there's a risk the network will momentarily split into two, then come back collectively anew. Transactions on the chain running old software, then, might eventually be lost.

While the situation observed closely, Theymos believes the risk of this occurring is small. But, he explained that people should still take precautions, such as waiting longer to make sure a bitcoin transaction gets verified.

Theymos continued:

"For the next week or so you should consider there to be a small probability of any transaction with less than 200 confirmations reversed."

False bitcoin?
What's on some users' minds, still though, is whether it's possible the bug has already exploited.

"How do we know if that vulnerability exploited already and there is someone out there with a bunch of fake bitcoin?" asked one bitcoin user.

Luckily, Bitcoin Core contributor Pieter Wuille explained, due to the power of code, bitcoin users would have been able to detect suspicious activity by now.

When downloaded for the first time, full nodes double check every transaction made in bitcoin's history. A node running the new software, 0.16.3, would detect the problem immediately.

Questions remain regarding what would have happened if the bug not caught in time.

According to Theymos: "Even if the bug had exploited to its full extent, the technical loss to stored funds would have been rolled back."

Theymos continued, saying that rollback would be much like what happened during the so-called "value overflow incident" in 2010 when 187 billion bitcoins created out of thin air but, ultimately, were destroyed.

However, while Bitcoin Core, litecoin and several other coins that were based Bitcoin Core's code have released a patch for the exploit, others have not – and might still be vulnerable to the inflation bug.


Post a comment

1 Comments