Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update btcd: btcd mishandles witness size checking #14845

Closed
robert-zaremba opened this issue Jan 30, 2023 · 5 comments · Fixed by #14846
Closed

Update btcd: btcd mishandles witness size checking #14845

robert-zaremba opened this issue Jan 30, 2023 · 5 comments · Fixed by #14846
Labels
dependencies Pull requests that update a dependency file T: Security

Comments

@robert-zaremba
Copy link
Collaborator

Summary

btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other Bitcoin-related products, mishandles witness size checking.

btcd should be updated to 0.23.3.

In Cosmos SDK we don't use btcd directly. We only use github.com/btcsuite/btcd/btcec which was extracted to it's own module only in v2.

I tried to make the update, but it requires Tendermint update as well.

Version

0.46.x

Steps to Reproduce

@robert-zaremba robert-zaremba added T: Security dependencies Pull requests that update a dependency file labels Jan 30, 2023
@robert-zaremba
Copy link
Collaborator Author

Tendermint should be updated as well.

@robert-zaremba
Copy link
Collaborator Author

NOTE: master was updated already.

@julienrbrt
Copy link
Member

julienrbrt commented Jan 30, 2023

Tendermint should be updated as well.

Right, this is why <= v0.46 has not been bumped. To completely remove the dependency is quite something, with Rosetta in <= v0.46 (next to TM). Are we even using witness size checking? We accelerated the removal of that dep in v047 and main because CI started to get pedantic.

For reference: tendermint/tendermint#9783, #13513, #14123, #14118 (comment).

@robert-zaremba
Copy link
Collaborator Author

we are using the library, so we should use the right version at least in the Cosmos SDK.

@julienrbrt
Copy link
Member

Merged in #14846

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file T: Security
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants