criticalvulnerability

#CriticalVulnerability
🚨 Attention $BTC application developers: critical vulnerability in “bitcoinjs-lib”

Two serious bugs have been fixed in the popular `bitcoinjs-lib` library. These flaws could cause applications to catastrophically underreport miner fees for fully valid, signed PSBT (Partially Signed Bitcoin Transaction) transactions.

What is the issue?
In Bitcoin, the fee is the difference between the sum of the inputs and the sum of the outputs. Two distinct logic errors caused the library to report a minimal fee (e.g., 200 or 1,000 satoshis), while the actual amount deducted from the wallet and paid to miners could be as high as nearly 1 BTC (900 million satoshis).
1. Conflicting Input Values: The signing process utilized the full data from the previous transaction, whereas the fee calculation module relied on a conflicting record with a lower value. While the signature remained valid, the fee calculation was incorrect.
2. Missing Input-Value Records: For finalized inputs where the amount was not specified, the library treated the value as "0." This allowed a massive actual fee to be hidden within imported transactions.

Which versions are affected? v5 series: fixed in
➡️ 5.2.2 (vulnerable: 5.1.0 – 5.2.1)
➡️ v6 series: fixed in 6.1.9 (vulnerable: 6.0.0 – 6.1.8)
➡️ v7 series: fixed in 7.0.4 (vulnerable: 7.0.0-rc.0 – 7.0.3)

What should you do?
➡️ Update to the patched versions (5.2.2, 6.1.9, 7.0.4).
➡️ If updating is not currently possible, implement independent verification of input values ​​and reject any inconsistent entries before signing or calculating fees.

The security of your application depends on whether you blindly trust libraries or verify every single satoshi. 🛡️

通貨 $ZEC 、バイナンスでのプライバシーコインのリーダー、$629から24時間以内に$300未満に急落！理由は？オーチャードプロトコルに存在した4年間の重大な脆弱性で、理論的には発見不可能な偽のZECコインをブロックチェーン上で生成する可能性があった。
最悪なのは？プライバシーシステムであるため、過去にその脆弱性が実際に悪用されていないことを証明することができない。このため、BitMEXの創設者アーサー・ハイズは、最大の支持者の一人だったにもかかわらず、ZECの所有物をすぐにすべて売却しました。
#zec #zcash #PrivacyCoin #CriticalVulnerability