Hi Insiders. This is Tuma, open-source reporter from the Insider Edition.
In this week’s update we feature the latest releases in the ecash ecosystem, Fedimint v0.12.0 and Cashu Dev Kit (CDK) v0.18.0.
We also cover the recent hack to the Liquid Network. Attackers, who stated to be whitehats, were able to stole 3998 bitcoin with a peg-out transaction leveraging a bug in the transaction validation logic.
We finally cover some other news, such as an implementation of multisig in Bitcoin Core GUI and a proposal to use silent payments in the coinbase transaction to pay miners for their hashrate.
Highlights from the Bitcoin developer ecosystem
I spent 10+ hours in open-source developer calls in the Bitcoin ecosystem last week. Here is what caught my eye:
Fedimint release v0.12.0 is out with new v2 modules, support for Iroh v1.0, and more.
During the weekly call, on Monday 31st, Fedimint developers discussed the release of Fedimint v0.12.0, called “Second Nature”.
The name of the release is linked to the fact that all the new v2 modules — lnv2, mintv2, and walletv2 — are now the default, with the older versions now labeled as “legacy”. Moreover, the latest version supports Iroh v1.0, the first stable release for the p2p networking stack.
v0.12.0 also improves the overall reliability of the system, reduces latency in Lightning payments, and allows recovery with no downtime and no blocking or stalling. Developers also released UniFFI bindings for Kotlin and Swift.
Cashu Dev Kit (CDK) release v0.18.0 is out, bringing the implementation up-to-date with the latest protocol changes.
During the weekly call, on Wednesday 2nd, CDK developers announced that they had just released the new version of the Cashu implementation, v0.18.0.
One of the most important changes is related to the mint configuration and settings. Previously, the mint configuration could be overridden by local settings and environment variables. v0.18.0 stores the authoritative settings in the primary mint database. The team provided a migration guide for mint operators.
The release also adds support for animated QR codes (NUT-16), signature-based authentication for mint quote redemption (NUT-20), BOLT12 offers descriptions (NUT-25), and deterministic nonces for DLEQ for offline ecash (NUT-12).
A BIPs Update
There was no newsworthy update in the last few days in the BIP repository. We’ll provide new updates as soon as a new BIP gets published or gets assigned a number.
Other News from the Bitcoin World
Liquid Hacked: On Sunday 6th, news got around that the Liquid Network, Blockstream’s sidechain, had been hacked by whitehats. The attackers stole 3998 bitcoin from the Liquid bridge.
Hackers contacted Blockstream directly onchain using an OP_RETURN. The discussion went back and forth, with the attackers asking the company to fix the bug before returning the funds. Developers Sjors shared a gist reporting all the discussion between hackers and Blockstream.
The bug seems to be connected to confidential transactions (CT), one of the feature available on the Liquid network that allows a user to hide the amount and the type of asset being sent by default. Since CTs do not show the amount being spent, two types of proofs are needed to verify that a transaction is valid: a balance proof and a range proof. The former checks that the amounts of L-BTC in input and in output are the same. The latter, checks that an hidden output falls within a positive amount.
Calle provided a possible explanation of what happened. Basically, since the range proof is particularly expensive to compute, Liquid nodes can cache a successful proof in memory, stored by assigning a label called cache key. Attackers were able to build two transactions with colliding cache keys. The first one was a valid transaction, checked by nodes and stored. The second one, on the other hand, was an invalid transaction, effectively creating L-BTC out of thin air. However, having the same cache key, nodes did not perform all checks and made it pass as valid.
The situation is still evolving. Check out BTC++ Insider Edition X account for the latest updates
Silent Payments in Coinbase Transactions: Developer average_gary wrote a post on Delving Bitcoin explaining his idea to use silent payments to allow miners to get paid to different addresses for the provided hashrate without revealing an xpub.
The proposal would require a dedicated BIP since it is not currently possible to use the silent payments protocol defined in BIP352 as it is. The author is looking for feedback on the idea before moving on to a formal draft.
Multisig in Bitcoin Core GUI: Developer sdbtc announced that he was able to integrate multisig in the Bitcoin Core GUI by using Claude. He is now reviewing the code created by the LLM and polishing the implementation with the objective of opening a real PR in the repository.
Reads from BTC++ Insider Edition
BitPolito: How Italy’s Largest Bitcoin Student Org Is Passing the Reins to the Next Generation
Don’t start a node in the past - This Week in Bitcoin Core #56
Looking for an opportunity to join up with some bitcoin devs in person? Join us in Berlin this October 1- 3 to talk about payments in Bitcoin!