bitcoin-dev

A "Free" Relay Attack Taking Advantage of The Lack of Full-RBF In Core

A "Free" Relay Attack Taking Advantage of The Lack of Full-RBF In Core

Original Postby Antoine Riard

Posted on: July 24, 2024 00:44 UTC

The evolution of Bitcoin Core's development culture over the past 15 years has seen significant shifts, largely influenced by its contributors' backgrounds and the project's responses to contentious technical debates.

Initially, the project benefited from contributions by veterans of open-source projects, old cypherpunks, and individuals with a deep understanding of security system engineering. These contributors were adept at evaluating technical arguments on their merits, which ensured that weak ideas were discarded when a consensus was reached among the majority. This rigorous approach to development fostered an environment where scientifically grounded and skilled contributors were willing to risk their careers to advance the Bitcoin Core codebase.

However, the atmosphere within the Bitcoin Core community began to change, particularly after the "block size war," leading to a more cautious stance among senior contributors. Some took a step back without fully passing on their high standards of technical and ethical rigor to newcomers. This transition period coincided with the Faketoshi lawsuits, further causing experienced contributors to retreat from active participation. Concurrently, there was a push towards professionalizing the space, evidenced by an increase in open-source grants. These grants, while supporting the work of many dedicated contributors, sometimes gave the impression of being awarded based on external social factors rather than merit. This shift also encouraged the implementation of complex code in low-level subsystems, prioritizing the ability to showcase achievements over thorough design and review processes.

The cultural transformation within the Bitcoin Core community has not been without consequences. The proliferation of open-source grants as a primary mode of compensation has introduced a reluctance among contributors to critically review each other's work, fearing repercussions on grant re-attribution. This self-censorship is compounded by a desire to avoid personal financial loss in the event of major security failures, leading to a less adversarial review process that might compromise the safety of end users' funds.

In response to these challenges, suggestions have been made to fork the core or establish multiple security mailing lists to maintain a collaborative culture among different full-node implementations. However, the focus remains on fostering goodwill and collaboration regardless of the communication channels used. Recent acknowledgments by Bitcoin Core contributors about the project's historical shortcomings in disclosing security-critical bugs highlight the need for cultural shifts towards better security issue handling practices. This openness about past vulnerabilities is a step towards improving the overall security of the Bitcoin ecosystem, emphasizing the importance of transparently addressing and mitigating risks before they can be exploited by malicious actors.