Overview
- The final release is set for October 10.
- Enhancements will improve block verification speed and modify transaction formats used by wallets.
- Security patches will resolve issues with harmful wallet names and high server memory usage.
The Bitcoin software that allows users to independently verify Bitcoin transactions is set for an update aimed at improving verification speed and addressing security vulnerabilities, with a launch planned for October.
Bitcoin Core 32.0 has entered the release-candidate phase as of Monday, according to the project’s schedule. Developers are working towards an October 10 completion date, although this timeline may shift based on testing outcomes.
Myriad: What’s the next move for Bitcoin? Share your prediction.This update primarily impacts node operators and developers utilizing the software for wallets and other services, enabling computers to verify Bitcoin transactions and blocks.
As detailed in the draft release notes, the update will accelerate block verification by allowing parallel reading of database information, without altering the rate at which Bitcoin blocks are generated. Additionally, four wallet commands will default to a new format for sharing partially signed transactions between wallets and signing devices, though older formats will still be accessible if requested.
One of the security improvements prevents specially crafted wallet names from executing commands on a node’s system. This issue was particularly pertinent for non-Windows platforms where an authenticated user could create wallets, triggering the walletnotify feature to execute commands during wallet transactions.
Another patch addresses excessive memory consumption in the new HTTP server, which processes requests from connected applications.
Contributor Matthew Zipkin, known as pinheadmz, highlighted a “memory exhaustion scenario” in his patch proposal. He noted that the risk was primarily confined to authenticated clients.
Zipkin discovered this vulnerability while reviewing Bitcoin Core’s new HTTP server with Kimi K3, an AI model also utilized by the Bitcoin Red Team to identify software vulnerabilities. He explained that while a previous fix addressed part of the issue, a method to deplete the computer’s memory—resulting in an “OOM” or out-of-memory state—persisted.
During the analysis of the same patch, GitHub user jeanpablojp identified that unauthenticated requests could also lead to increased memory usage when the REST interface was active. After Zipkin updated the patch, the reviewer noted that 16 unauthenticated connections resulted in approximately 3 MB of memory growth over 90 seconds, a significant reduction from the previous 3.2 GB.
This patch was incorporated into Bitcoin Core 32.0 on September 5 as part of ongoing efforts to enhance the software's security.
In recent weeks, other Bitcoin developers have also tackled various vulnerabilities. BitBox, a hardware wallet manufacturer, patched two critical firmware vulnerabilities in August, reporting no known instances of exploitation. Additionally, developers of the Core Lightning payment software have issued warnings to node operators regarding confirmed vulnerabilities while working on fixes.