Login Request a demo
High severity · published May 5, 2024
CVE-2024-34478
btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BT
Btcd · Btcd Project
before 0.24.0 · source: NVD, CISA
Affected product
BT
Btcd
Btcd Project
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-34478
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-34478
Issue Tracking
https://delvingbitcoin.org/t/disclosure-btcd-consensus-bugs-due-to-usage-of-signed-transaction-version/455
Product
https://github.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/blockchain/chain.go#L383C1-L392C3
Product
https://github.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/txscript/opcode.go#L1172C1-L1178C3
More from Btcd
9.8
CVE-2022-44797
btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other Bitcoin-related products, mishandles witness size checking
8.1
CVE-2024-38365
btcd did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality
7.5
CVE-2018-17145
Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with random hashes, aka…
6.5
CVE-2022-39389
Lightning Network Daemon (lnd) is an implementation of a lightning bitcoin overlay network node