@federico_rivi@st3b1t@Albi_on_Air Oggi ho sentito che deve essere garantito il "diritto universale alla felicità " 🤣. Questa nemmeno a miss Italia la dicevano
Liquid hack explained.
Liquid has confidential transactions that hide the amounts for improved privacy. A bug in how these transactions are validated caused inflation of Liquid BTC (L-BTC) and allowed hackers to empty the entire side chain.
Liquid nodes don't see the amounts of a confidential transaction, so to make sure that the transaction is still valid and doesn't cause inflation nodes check something called a balance proof and a range proof.
The balance proof establish that sum of the input amounts equal the output amounts, i.e., that "x L-BTC going in and x L-BTC going out". But there's a catch. Only relying on a balance proof isn't enough. You also need the range proof.
The range proof establishes that a hidden output amount falls within a positive range. That means a valid output must be at least 1 L-sat and at most 2^64 − 1 L-sats. Range proofs make sure that you can't mint "negative L-BTC".
Why is this even necessary? Remember, the amounts are hidden and a hidden negative amount would allow extra positive outputs to balance against it. Without a range proof, a transaction could say "I've put 1 L-BTC in, and I'm taking two outputs out: one with 4000 L-BTC and one with -3999 L-BTC)."
This is going to cause a disaster in a little bit.
Once the balance proof, the range proof, and other validations pass, a transaction is regarded as valid and can pass consensus. However, because especially the range proof is computationally expensive, Liquid nodes cache the result of a successful range proof in memory. Essentially, the node remembers "I saw this range proof before and it was valid, all good!".
In order to recognize the same range proof later on, you need to assign a label to it. This is called a cache key. This cache key is the actual cause of the bug.
The way this cache key was constructed allowed two different transactions to collide on their cache key. Essentially, one valid transaction (1 L-BTC in, 1 L-BTC out) had the same cache key as an invalid transaction (1 L-BTC in, 4000 L-BTC out).
Here's the hack: the attackers submitted the valid transaction (1 L-BTC in, 1 L-BTC out) first. Liquid nodes verified this transaction successfully, created a cache key called REKT and stored it in their cache. Then the attackers carefully crafted a second invalid transaction with (1 L-BTC in, 4000 L-BTC out) that created the same cache key REKT.
Instead of validating the second transaction and realizing that it printed money out of thin air, Liquid nodes found it in their cache and said "hey I saw this transaction before, everything is fine" and that caused the inflation.
The attackers then took their 4000 L-BTC and withdrew 4000 BTC onto the Bitcoin base chain.
Note: I might have gotten some details wrong, and I'm aware that I simplified quite a bit. I wrote this post to help people understand what happened. Please feel free to correct me in the comments or add more details below.
- Government: "Nobody can compete with our currency."
- Bitcoin: "I don't compete. I just exist."
- Government: "You're too volatile!"
- Bitcoin: "I'm 17. You're 55 and down 97%."
- Government: "You're not backed by anything!"
- Bitcoin: "I'm backed by math. You're backed by promises."
- Government: "People trust us!"
- Bitcoin: "Then why is your printer a secret and my ledger public?"
- Government: "...You're not an economist."
- Bitcoin: "No. I'm the audit."
There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds.
Please update your BTCPayServer to 2.4.2 by going to Admin Dashboard -> Server -> Maintenance -> Update & verify the 2.4.2 version string in the footer.
If you are unable to update right away, turn off your BTCPay Server to prevent unauthorized access until you can update.
@BlockstreamJade also i think most bitcoiners don't realize in effectively all HWWs with (physical) SEs, the SE just verifies the PIN, and transfers the seed or master private key to an MCU. the MCU security isn't SE level. so the distinction is more academic than people are understanding.
ZEUS infrastructure is temporarily offline following a cybersecurity incident.
The attack has been mitigated. We are keeping services offline while we conduct a comprehensive audit of all systems before restoring operations.
**Customer funds were neither lost or at risk.**
@federico_rivi E se gli agenti decidessero autonomamente di convertire una parte delle stablecoin in ₿, considerandolo la riserva di valore definitiva? 🤖
40 Followers 1K FollowingOnly private elite here!! I will mainly talk about Crypto market, price action analysis etc. ONLY FOR A FEW PEOPLE MAIN ACCOUNT @ericyakes
17K Followers 14K FollowingWhat a good time to live the Bitcoin revolution! Donation: ⚡️[email protected] | bc1pf3qut2xjxrv9pdt3fhx08rk42ly2a8qw0g9q9ak5e2fk5449mgpsuuu0ux
191 Followers 206 FollowingHobbies: Golf⛳ tennis🎾watching football games⚽
Like to share life
Dream is to find true love and spend the rest of life together
279 Followers 2K FollowingI’m a professional massage That’s what am doing for a living and am very good in it just DM if you like to have a body massage 💆♀️
44 Followers 2K FollowingSUBSCRIBE TO MY POLITICS NEWSLETTER: https://t.co/fsqTMNXE5L Chris-Newslett... SUBSCRIBE TO MY SPORTS NEWSLETTER: https://t.co/rK80pMmGrB
376 Followers 832 FollowingDo what you like to do, do what you are good at, get back the joy of success, get back the lost confidence, and find the motivation and direction to mov⛳️⛳️⛳️⛳️
272K Followers 3K FollowingPentester, Forensic investigator, and former college professor. Trained hackers at each US military and intelligence.
Visit me at https://t.co/G478wug0p4
306K Followers 14K FollowingCEO @Swan | Host of OUTSIDE MONEY | Investor in 60+ tech startups | Follow for Bitcoin, investing, markets, macro, and geopolitics | Truth, family and 🏀
113K Followers 16 FollowingOpinioni Senza Etichette.
Contro il #PoliticallyMerd e il moralismo arcipocrita.
Difendiamo l'irriverenza e la Libertà di dire il cazzo che si pare. Sempre.
19K Followers 373 FollowingJade by @Blockstream is an easy-to-use, purely open-source hardware wallet that offers advanced security for your Bitcoin and @Liquid_BTC assets.
213K Followers 2K FollowingBuilding the rails for Bitcoin finance. Enterprise, consumer, asset management.
The future of finance runs on ₿.
Support: @BlockstreamHelp
1.3M Followers 235 FollowingTutta l'informazione RAI gratis e in un click. Le news e i video, i telegiornali, gli approfondimenti, lo sport e le dirette dei grandi eventi
2.5M Followers 350 FollowingLe top news dell’ANSA, la più importante agenzia d’informazione in Italia. Ultim’ora, notizie, foto e video da tutto il mondo. Aggiornamenti 24 ore su 24. #ANSA
104K Followers 224 FollowingRoman #Catholic, husband, father of 11 children, #Bitcoin developer, and CEO @CONVOY_Mining; INTP;
I condemn fake "Catholics", cryptobros & pedos; see link
6.0M Followers 1K FollowingExecutive Vice President of The @Trump Organization. Husband to @LaraLeaTrump. Advocate of @StJude. @WorldLibertyFi @ABTC #MakeAmericaGreatAgain
222K Followers 4K FollowingSharing the most pivotal moments in #Bitcoin. Fmr CoinDesk & Bitcoin Magazine. Now @BTCTreasuries. Read my weekly takes → https://t.co/fS0v8Mpr2X
504K Followers 0 FollowingSentenced to die in prison. Pardoned by President Trump after spending 4,130 days (11+ years) in max security. Freedom is sweet!