Bitcoin Core

Bitcoin Core versions below 24.0.1 have a critical vulnerability affecting 17% of full nodes

ChainCatcher news, according to Protos, Bitcoin Core developers have issued a new high-risk warning, stating that one in every six Bitcoin nodes has a software vulnerability. On Thursday, the staff responsible for maintaining the open-source Bitcoin Core project, which runs on over 98% of reachable full nodes, disclosed that the software running on 17% of the nodes in the network has significant security issues. Specifically, all software versions below Bitcoin Core 24.0.1 are at risk. According to monitoring estimates from Bitnodes, this denial-of-service vulnerability affects approximately 3,330 of the 19,200 self-identified user agents of accessible Bitcoin full nodes.In Bitcoin Core software prior to version 24.0.1, malicious actors could spam nodes with low-difficulty header chains. By forcing nodes to download and store extremely long header chains, the attack could crash nodes by consuming excessive bandwidth or device storage space. Developers fixed this vulnerability in Bitcoin Core pull request (PR) number 25717 and merged it into production with the release of v24.0.1 on December 12, 2022. The current version of Bitcoin Core node software (now 27.1) includes fixes for this vulnerability and others.Although this vulnerability is quite serious, there are few known cases of attacks exploiting it in public records. The cost of generating and broadcasting block header chains to execute a denial-of-service attack is relatively high, making the vulnerability of little economic benefit to attackers.

Bitcoin Core developer Luke Dashjr's proposal to limit inscriptions was not approved, and opinions among inscription developers are mixed

ChainCatcher news, the proposal "datacarriersize: Match more datacarrying #28408" initiated by Bitcoin Core developer Luke Dashjr discussed the issue of whether to restrict inscriptions. After discussions among several Bitcoin Core developers, it was not approved, and the proposal is currently marked as closed.It is reported that Bitcoin Core developer Ava Chow summarized and closed this PR, stating that it is clear this proposal is controversial, and given the current situation, it is impossible to reach a conclusion that satisfies everyone, believing there is no need to continue the discussion.Additionally, another Bitcoin Core code maintainer, gloria, summarized this PR.Supporting Luke's viewpoint are:Stop inscriptions; they are spam;Inscriptions and embedded data can harm the network;People want this: there is user demand and specific use cases that Bitcoin Core should provide; another option is for people to write and run patches, but this may be unsafe;This is just fixing the data carrier size to work as intended;Opposing Luke's viewpoint are:This will not stop inscriptions; miners are unlikely to adopt this strategy as it is incompatible with incentives;We cannot write code to detect all embedded data;This PR changes the default mempool policy, posing potential harm to individual node operators and the network;Other opposing viewpoints include:Generally speaking, using mempool policies to block usage is ineffective;Attempting to "review" transactions based on usage is inappropriate; the free market determines the use of Bitcoin;This also changes the operation of -datacarriersize executed from underlying users.
ChainCatcher Building the Web3 world with innovators