The under is a right away excerpt of Marty’s Bent Factor #1278: “Any other LND/btcd worm emerges.” Join the e-newsletter right here.
by way of GitHub
For the second one time in lower than a month, btcd (an alternate implementation of Bitcoin) and, by means of extension, LND (some of the Lightning implementations) was incompatible with the remainder of the Bitcoin community because of some meddling from a developer named Burak.
On October 9, Burak finished a 998-0f-999 tapscript multisig transaction that btcd identified as invalid whilst Bitcoin Core and different implementations (as it should be) identified it as legitimate. Since LND’s implementation of the Lightning Community relies on btcd, it was incompatible with the remainder of the Lightning Community, due to this fact disrupting all in their customers’ talent to transact safely. No longer perfect.
Speedy-forward to the day past and Burak was once again once more to disrupt btcd and LND with the kind of transaction you spot above: a P2TR (pay-to-taproot) spend containing N OP_SUCCESSx with 500,001 pushes, which exceeds the prohibit hardcoded into btcd. Whilst the 998-of-999 tapscript multisig transaction gave the look to be a decent mistake, the day past’s transaction was once an overt exploit within the wild by means of Burak.
Evidence Burak knew this might damage LND
One thing to notice about this OP_SUCCESSx transaction is that it normally wouldn’t be incorporated in a block. Alternatively, it sort of feels that Burak bribed miners by means of attaching a in particular prime price to this transaction that F2Pool couldn’t face up to.
This example has surfaced numerous debate during the last two days. Used to be Burak improper to milk this worm within the wild on mainnet? Must he have correctly disclosed the vulnerability to btcd and LND in non-public, letting them patch the code ahead of the worm was once exploited within the wild? Must LND be depending on btcd, which is an alternate implementation of Bitcoin that doesn’t get just about as on the subject of the quantity of consideration and assessment that Bitcoin Core receives?
Your Uncle Marty indisputably doesn’t have the precise solutions to all of those questions, however it’s essential for you freaks to pay attention to these things so I assumed I’d convey them on your consideration.
That is the character of open supply disbursed techniques. There may well be numerous vulnerabilities lurking in the market and there is not any transparent solution to maintain the issues. Many will suggest for accountable disclosures in non-public whilst others will suggest for overt opposed movements that power the problem. This is among the trade-offs you select when you make a decision to choose right into a loose marketplace financial community.
