-
Notifications
You must be signed in to change notification settings - Fork 5
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
20 changed files
with
517 additions
and
110 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
22 changes: 22 additions & 0 deletions
22
...03ecc6475afb1653adc5ca3098d32234e02c6_Bitcoin-Core-28-1-Release-Candidate-1-Available.xml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| <?xml version='1.0' encoding='UTF-8'?> | ||
| <feed xmlns="http://www.w3.org/2005/Atom"> | ||
| <id>0</id> | ||
| <title>Bitcoin Core 28.1 Release Candidate 1 Available</title> | ||
| <updated>2024-12-06T02:41:00.866383+00:00</updated> | ||
| <author> | ||
| <name>Ava Chow 2024-12-05 21:07:00+00:00</name> | ||
| </author> | ||
| <generator uri="https://lkiesow.github.io/python-feedgen" version="0.9.0">python-feedgen</generator> | ||
| <entry> | ||
| <id>0</id> | ||
| <title>Bitcoin Core 28.1 Release Candidate 1 Available</title> | ||
| <updated>2024-12-06T02:41:00.866415+00:00</updated> | ||
| <link href="https://gnusha.org/pi/bitcoindev/[email protected]/T/#u#m03903ecc6475afb1653adc5ca3098d32234e02c6" rel="alternate"/> | ||
| <summary>The release candidate binaries for Bitcoin Core version v28.1rc1 are now accessible, providing the community with the opportunity to engage with and test the upcoming major version of Bitcoin Core. These binaries can be downloaded directly from [Bitcoin Core's official website](https://bitcoincore.org/bin/bitcoin-core-28.1/test.rc1/). Alongside the binaries, the source code has been made available on GitHub, allowing for thorough review and compilation by developers interested in exploring the new features and changes introduced in this version. The source code is located under a signed tag, which can be accessed at [this GitHub link](https://github.com/bitcoin/bitcoin/tree/v28.1rc1). | ||
|
|
||
| As part of the preparation for the new major release, preliminary release notes have been published to provide an overview of the updates, fixes, and enhancements included in version v28.1rc1. These notes are crucial for users and developers alike to understand the scope of changes and new functionalities being introduced. The release notes are available for reading at [GitHub](https://github.com/bitcoin/bitcoin/blob/v28.1rc1/doc/release-notes.md), offering insights into what to expect from the forthcoming official release. | ||
|
|
||
| Release candidates serve as a critical step in the software development cycle, aimed at identifying any remaining issues or bugs that need to be addressed before the final release. The announcement encourages recipients of the message, who are members of the Bitcoin Development Mailing List, to participate in the testing process. By doing so, they contribute to the stability and reliability of the upcoming version v28.1. Should the testing phase conclude without the identification of critical problems, the release candidate will be officially tagged as version v28.1, marking its readiness for widespread use across the Bitcoin network.</summary> | ||
| <published>2024-12-05T21:07:00+00:00</published> | ||
| </entry> | ||
| </feed> |
30 changes: 30 additions & 0 deletions
30
...Disclosure-Transaction-Relay-Throughput-Overflow-Attacks-against-Off-Chain-Protocols-.xml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| <?xml version='1.0' encoding='UTF-8'?> | ||
| <feed xmlns="http://www.w3.org/2005/Atom"> | ||
| <id>0</id> | ||
| <title>Full Disclosure: "Transaction-Relay Throughput Overflow Attacks against Off-Chain Protocols"</title> | ||
| <updated>2024-12-06T02:40:50.573884+00:00</updated> | ||
| <author> | ||
| <name>Antoine Riard 2024-12-05 17:48:00+00:00</name> | ||
| </author> | ||
| <generator uri="https://lkiesow.github.io/python-feedgen" version="0.9.0">python-feedgen</generator> | ||
| <entry> | ||
| <id>0</id> | ||
| <title>Full Disclosure: "Transaction-Relay Throughput Overflow Attacks against Off-Chain Protocols"</title> | ||
| <updated>2024-12-06T02:40:50.573917+00:00</updated> | ||
| <link href="https://gnusha.org/pi/bitcoindev/CALZpt+EptER=p+P7VN3QAb9n=dODA9_LnR9xZwWpRsdAwedv=w@mail.gmail.com/T/#u#m4fcd81d3fbf25a2571b51eba2221cea7238279cd" rel="alternate"/> | ||
| <summary>The report delves into a newly identified transaction-relay jamming attack targeting bitcoin time-sensitive contracting protocols, particularly affecting lightning channels. This attack exploits the transaction selection, announcement, and propagation mechanisms inherent in the base-layer full nodes of the Bitcoin network. Initially, concerns regarding similar vulnerabilities, specifically bip125 replace-by-fee rules, were raised among bitcoin protocol developers back in 2020. However, the focus shifted due to more pressing security issues within the lightning protocol at that time. | ||
|
|
||
| In mid-2023, detailed concerns about "transaction-relay throughput attacks" were communicated privately to seasoned bitcoin and lightning developers. These discussions highlighted the technical feasibility and potential impact of such attacks, though they were not prioritized until recent developments in 2024 brought them back into consideration. The attack manipulates full-node bandwidth through what's termed as free relay attacks, drawing attention to the practical implications and costs associated with executing such attacks on the network. | ||
|
|
||
| Two specific variations of the attack are outlined: the "high overflow" and the "low overflow" variants. The "high overflow" attack focuses on congesting the transaction relay process by flooding the network with high fee-rate transactions to prevent time-sensitive transactions from being propagated efficiently. A proof-of-concept for this attack was tested on bitcoin core v27.0, demonstrating its viability under certain topological configurations but without real-world workloads. The "low overflow" attack, meanwhile, aims at overwhelming the receiver's capability to process incoming transactions by reaching the MAX_PEER_TX_ANNOUNCEMENTS limit, causing subsequent transactions to be dropped. This variant's practical testing and confirmation remain an open area for investigation. | ||
|
|
||
| The report further discusses the estimated costs associated with launching a "high overflow" attack, emphasizing its significant financial requirement but noting its potential effectiveness in partitioning a victim's mempool from the broader network. This aspect highlights the strategic approach an attacker might use to minimize on-chain fees while maximizing disruption. | ||
|
|
||
| Mitigation strategies are proposed, focusing primarily on measures that can be implemented by lightning node operators and off-chain protocol developers. Recommendations include random transaction rebroadcasting, dynamic fee rebroadcasting, limiting identical finality time-sensitive transactions, and over-provisioning transaction-relay throughput with adjacent full-nodes. These strategies aim to enhance resilience against both presented attack variants, although the report suggests that a comprehensive solution may require intervention at the base-layer level. | ||
|
|
||
| The timeline of the report's formulation and disclosure process is meticulously documented, from initial findings and discussions in June 2023 to the communication of a public disclosure date in November 2024. This timeline underscores the careful consideration and coordination among stakeholders in addressing the vulnerability. | ||
|
|
||
| In conclusion, the report introduces a plausible threat vector against lightning channel funds through transaction-relay jamming attacks, warranting further investigation and experimentation. It presents a baseline for understanding the technical underpinnings and potential defenses against such attacks, contributing to the ongoing dialogue around securing decentralized financial networks against sophisticated adversarial tactics.</summary> | ||
| <published>2024-12-05T17:48:00+00:00</published> | ||
| </entry> | ||
| </feed> |
Oops, something went wrong.