bitcoin-dev
Full Disclosure: CVE-2023-40231 / CVE-2023-40232 / CVE-2023-40233 / CVE-2023-40234 "All your mempool are belong to us"
Posted on: October 20, 2023 06:56 UTC
In the email, the sender mentions that they have written a reply regarding the economics of sequential malicious replacement of honest HTLC-timeout.
They also mention that they have conducted a test on core mempool, which has yielded expected results. The sender provides a link to the test they conducted on GitHub.
The sender goes on to discuss the responsible disclosure process and compares it to hardware issues affecting the operating system, specifically referencing the Linux kernel. They provide a link to documentation on the process for embargoed hardware issues.
Next, the sender states that they are halting their involvement with the development of the lightning network and its implementations. They mention that they have informed senior lightning developers about this decision. Additionally, they mention closing an old issue related to this on the bolt repository and provide a link to it.
The sender expresses their concern about a new class of replacement cycling attacks, stating that it puts the lightning network in a perilous position. They believe that a sustainable fix can only happen at the base-layer, such as adding a memory-intensive history of all-seen transactions or a consensus upgrade. They acknowledge that current mitigations may be effective against simple attacks but may not stop advanced attackers.
The sender emphasizes the importance of transparency and community buy-in when making changes that alter the processing requirements or security architecture of the decentralized Bitcoin ecosystem. They highlight the difficulty of explaining why these changes are necessary and suggest that practical and critical attacks on the public BTC ecosystem may need to be outlined.
They mention a dilemma in terms of Bitcoin protocol deployment and the need to get it right on the first try, as there may not be a second chance to fix them during implementation. The sender states that they will remain silent on these issues on public mailing lists until the week of October 30th, as enough material has already been published and other experts are available. After that, they plan to focus more on Bitcoin Core.
The email concludes with a farewell message and the sender's name.