Core

Bitcoin

A group of Bitcoin Core developers has launched a “critical bug” disclosure policy aimed at more effectively communicating Bitcoin security vulnerabilities. 
“The project has historically done a poor job at publicly disclosing security-critical bugs, whether externally reported or found by contributors,” Bitcoin core developer Antoine Poinsot and five others <a href="https://groups.google.com/g/bitcoindev/c/Q2ZGit2wF7w" target="_blank" rel="noopener nofollow">wrote</a> to members of the Bitcoin Development Mailing List on July 3.
This has led to a situation where Bitcoin users are led to believe that Bitcoin Core is free of bugs, but Poinsot stressed that this simply isn’t the case.
<blockquote data-ct-non-breakable="true">
 “This perception is dangerous and, unfortunately, not accurate.”
</blockquote>
Bitcoin Core is the software that <a href="https://cointelegraph.com/learn/bitcoin-nodes-vs-miners">Bitcoin node operators</a> download to access the Bitcoin blockchain, validate transactions and build blocks. It plays a crucial role in <a href="https://cointelegraph.com/learn/what-is-bitcoin-a-beginners-guide-to-the-worlds-first-cryptocurrency">securing more than $1.1 trillion</a> locked in the Bitcoin network.
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2024-07/965e3ba0-43a4-4fc4-8d4f-b83a393c983c.png">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/darosior/status/1808489727730786365" target="_blank" rel="noopener nofollow">Antoine Poinsot</a>
 </figcaption>
</figure>
Poinsot said the new policy would allow better communication about the risk of running outdated versions of Bitcoin Core and would provide a standardized disclosure process that would give researchers more incentive to find and responsibly disclose vulnerabilities. 
<blockquote data-ct-non-breakable="true">
 “Making the security bugs available to the wider group of contributors can help prevent future ones.”
</blockquote>
The new disclosure policy will categorize vulnerabilities based on four levels of severity.
The first category, “low,” includes bugs that are hard to exploit and have low impact, such as a wallet bug that requires access to the victim’s machine. 
The second category, “medium” are bugs with limited impact, such as local network remote crash. 
The last two categories include bugs of “high” severity that could have significant impact, while the “critical” severity are ones that threaten the entire network’s integrity.
An example of a critical bug could involve manipulating Bitcoin Core to inflate <a href="https://cointelegraph.com/explained/can-bitcoins-hard-cap-of-21-million-be-changed">Bitcoin’s hard-capped supply</a> or committing a “coin theft.”
Low, medium and high bugs will aim to be disclosed two weeks after a fixed version is released, while disclosures for <a href="https://cointelegraph.com/news/cosmos-patches-bug-ibc-protocol-saves-126m">critical bugs</a> will be determined on a case-by-case basis.
Related: <a href="https://cointelegraph.com/news/bitcoin-ordinals-demand-new-bitcoin-fork">Bitcoin Ordinals proponents should demand a new Bitcoin fork</a>
The policy will be “gradually adopted” in the coming months, Poinsot added.
Poinsot noted that all vulnerabilities fixed in Bitcoin Core versions 0.21.0 and earlier has been disclosed as of July 3, and disclosures for versions 0.22.0 and 0.23.0 will come out later this month and in August.
Bitcoin Core version 27.1 is the latest version adopted. 
The new policy received praise from fellow Bitcoin Core developer Eric Voskuil:
<blockquote>
 “Many other projects have been on the receiving end of this misperception, and it has in fact caused material harm to the community. I don't know what precipitated this change, but props to you all for stepping up.”
</blockquote>
Magazine: <a href="https://cointelegraph.com/magazine/bitcoin-layer2-sidechains-not-really-bitcoin-l2s/">‘Bitcoin Layer 2s’ aren’t really L2s at all: Here’s why that matters</a>

Bitcoin Core devs set up new policy aimed at handling ‘critical bugs’

Cointelegraph

Other articles published on Jul 4, 2024

Bitcoin Cash Experiences Significant Hashrate Increase Despite Price Drop

Why Bitcoin hasn’t surged? Key industry leaders may hold the Answer

GoMining News #1

Solana ETF Launch Tied To 2024 Presidential Election, VanEck Research Head Explains

Lido Staked Ether Down More Than 5% Within 24 hours

Why Bitcoin could stay low until October: What analysts are saying

Join our free newsletter for daily crypto updates!