Bitcoin Core Code Vulnerability And Threats It Poses
What are we talking about?
On September 20, 2018, the BitcoinCore website published a disclosure post about CVE-2018-17144. CVE-2018-17144 is the name of the bug found by Awemany, a developer of Bitcoin Cash and Bitcoin Unlimited projects. The discovered vulnerability was called “very scary”, as it might potentially cause enormous damage to the entire Bitcoin network with a double-spending attack without involving 51% of hash power. The situation is aggravated by the fact that BitcoinCore nodes constitutes the majority of the current network users. It is also known that at least the Litecoin networt is at risk.
Even though the first messages about bug fixing appeared on September 18 and the hazard itself seemed to be found and disclosed to responsible persons on September 17th, as of October 18th, 84.7% of the whole Bitcoin network were using unpatched software.
What the CVE-2018-17144 bug actually is
According to National Vulnerability Database, the bug allows a miner to execute a distant DoS (software crash) by copying transaction input. The report was published on the website on September 19 and contains several important links, such as BitcoinCore disclosure, several GitHub explanations, and the vulnerability description on the Bitcoinwiki webpage. The report data states that an attacker can create coins outside known network rules, while the attack itself requires mining blocks. The flaw is described as “Missing check for duplicate inputs”.
The BitcoinCore improvement process of 2016 included a change called Bitcoin Core PR #9049. On October 31, 2016, a long-time Bitcoin developer Matt Corallo, who has actively contributed to Bitcoin Core, wrote a comment: “Benchmark results indicate this saves about 0.5-0.7ms during CheckBlock.” It seems that by November 10, 2016, all changes were implemented or at least were at the final stage. Next comments describe the changes for bug fixing. The following discussion is also interesting: some participants were focused on the source of this problem, its implementation details, and review issues.
The interesting point is that initially this threat was found for BitcoinABC. Afterward, the correspondent check showed the same failure result for the Bitcoin Core program.
Meanwhile, the Bitcoin Core team stated that CVE-2018-17144 has a chance of Denial of Service and both a critical influence threat. We draw a conclusion that the DoS threat was just a semi-problem, and the whole network might be subjected to much heavier consequences (or is subjected to them right now).
Response to the bug
The response was planned to be two-step. First, it was necessary to release the fix for the DoS part. The second step would be taken after the network was filled with corrected client versions. According to the report mentioned above, more than half of the Bitcoin hashrate has already been patched. No vulnerabilities have been detected so far.
What conclusion can we draw? Well, there are several important issues:
- Every code line must be checked carefully. It is impossible to write a perfect code, thus several programmers have to revise it and verify its logic.
- Unfortunately, even old patches are potentially harmful. Intended to be useful, they might cause a lot of problems later.
- A quick and active community response is good.
In any case, the discovered bug is reported to still have some space for conspiracy. The vulnerability was a perfect way to eliminate Bitcoin value. However, we will unlikely ever know it for sure.