Vulnerability that allowed Ordinals to exist now has its own CVE code

nutildah

legendary

Activity: 2940

Merit: 7892

Quote from: NotATether on December 14, 2023, 04:30:52 AM

Everyone is just trying to create some useless JPEG "art" that they can inscribe, hope some sucker appreciates the "value" of such a drawing and then buy it at a huge loss.

Not "everyone," but yes it would appear the majority of it is highly grifty and most people are in it for the grift, as are 99.9% of BRC-20 token makers/minters. Here's one such exception - this is cool AF - a working chess game as an inscription:

https://ordinals.com/inscription/d412d1aa997583ec5c558bee031291bac78f9f9a8acb2edccd2b6e19df64c9bbi0

There's a lot of innovative stuff happening on ordinals but we don't hear about it cuz there's no money in marketing it.

Quote from: NotATether on December 14, 2023, 04:30:52 AM

If some centralized digital trading cards company were to launch and make this exact same trading model but without blockchains, it is almost guaranteed that everyone will just go there and the Ordinals hype will dry up. Just like how they ditched NFTs for Ordinals.

They have already... Topps, which was at least at one time the biggest sports card company in the world, started releasing cards on the WAX blockchain. It flopped and they moved to their own private ledger system.

An Ordinal is an NFT, as defined by their common users. Name registrations on Namecoin and fungible tokens with pictures are also NFTs. Sorry, I don't make the rules.

Ordinals users are already blockchain users. They're not moving to a private system. That's for newbs still making the jump from physical to digital.

ABCbits

legendary

Activity: 2856

Merit: 7410

Crypto Swap Exchange

Quote from: takuma sato on December 14, 2023, 12:24:59 AM

Im starting to question if taproot was a good deal. Unpopular opinion, but does the pros outweight the cons?

Yes. Signature aggregation (on certain type of TX) allow smaller TX size while Taproot in general let you only certain part of the script which also allow smaller TX size and somewhat improve your privacy.

Quote from: takuma sato on December 14, 2023, 12:24:59 AM

As far as I can tell stuff like Ordinals were never possible before taproot

That's not true, Ordinals and others utilize witness data which has been possible since SegWit. And as reminder, NFT protocol on BTC already exist before SegWit.

NotATether

legendary

Activity: 1568

Merit: 6660

bitcoincleanup.com / bitmixlist.org

Quote from: nutildah on December 12, 2023, 05:54:20 AM

The appeal of ordinals (and inscriptions) is having your data stored in the world's most secure and popular blockchain. Even if its just used as a marketing ploy, that's where the allure lies. There are already tons of other blockchains in which massive amounts of data can be stored. A few of them, such as Arweave, were created exactly for that purpose. Ordinals people don't want to use other blockchains... Well I mean they are now, but they're not as popular.

Everyone is just trying to create some useless JPEG "art" that they can inscribe, hope some sucker appreciates the "value" of such a drawing and then buy it at a huge loss.

If some centralized digital trading cards company were to launch and make this exact same trading model but without blockchains, it is almost guaranteed that everyone will just go there and the Ordinals hype will dry up. Just like how they ditched NFTs for Ordinals.

pooya87

legendary

Activity: 3430

Merit: 10505

Quote from: electronicash on December 10, 2023, 01:24:25 PM

won't this cause a fork since there are also people who supported ordinals?

It depends on how it will be fixed, if it were through a fork where the exploit becomes invalid, then it would require majority support (like any other fork) and if it reaches that majority, there won't be any chain split.
But so far the proposals and efforts to prevent the abuse has been through policy rules, meaning these spam transactions would become non-standard not invalid. Meaning nodes would refuse to relay such transactions but they will verify them if they are already in a block.

Quote from: takuma sato on December 14, 2023, 12:24:59 AM

Im starting to question if taproot was a good deal. Unpopular opinion, but does the pros outweight the cons?

No, Taproot introduced Schnorr signatures which is an excellent addition. It not only slightly compresses the signature+public key that we use each time spending a coin but also adds the option for key aggregation which decreases the size of multi-sig scripts to be the same size as a single-sig. It also makes using more complex scripts with branches that don't all need to be releveled on chain easier.

The problem is that with introduction of SegWit, certain rules became looser opening up the possibility for this type of abuse. All we have to do is to reintroduce those strict rules into full nodes again.

takuma sato

sr. member

Activity: 281

Merit: 408

Im starting to question if taproot was a good deal. Unpopular opinion, but does the pros outweight the cons? As far as I can tell stuff like Ordinals were never possible before taproot, so at this point im wondering, if it should have passed. I just see BTC as good enough as it is withotu any more bells and whistles. Transaction must move from A to B, onchain, even if more expensive, at a reasonable rate. But ORDI is just artificially cluttering the blockchain, by artificially I considering anything that isn't moving coins from A to B. Perhaps it's worth it for the LN improvements in delivers. We'll see how it plays out on the long term.

alani123

legendary

Activity: 2394

Merit: 1411

Leading Crypto Sports Betting & Casino Platform

Quote from: nutildah on December 12, 2023, 05:54:20 AM

- Monero (Mordinals... believe it or not, its a thing now Cheesy

)

I'm pretty sure if any developer were to move fast preventing on-chain spam, if would be Mknero's.
It's pretty easy to patch any decentralized cryptocurrency so that their nodes no longer transmit this type of data. No hard fork needed.
Already I think the hype of Ordinals on Monero died before it actually managed to catch on, but they could be done with it any moment.

nutildah

legendary

Activity: 2940

Merit: 7892

Quote from: ABCbits on December 13, 2023, 05:50:10 AM

And as i said previously, people who own ordinals generally don't care how "ownership" works. Few of them even use Ordinals only to store arbitrary data on Bitcoin blockchain. Although in case reference software[1] change how ownership work, people will resort by keep using wallet and website which use old "ownership" system.

Its not a decentralized protocol like Bitcoin, and nobody ever claimed that it was. Participants agree to the set of currently-established rules, hoping that it will continue to be enforced and not change (or if it is changed, its to resolve some kind of recurrent problem). This is how all Bitcoin-based protocols work. And it hasn't been without its hiccups, but to say it flat out "doesn't work" like franknbeans claims is a straight up lie.

Quote from: ABCbits on December 13, 2023, 05:50:10 AM

Although Monero community took Ordinals problem seriously by adding limit size on TX_EXTRA[2].

I skimmed through the "How It Works" section on the website I linked and it seems like there is potentially some deanonymization of the sender at risk each time a send is performed. But outside of adding to (comparatively mild) blockchain bloat, regular users of Monero remain unaffected. I don't see it catching on.

ABCbits

legendary

Activity: 2856

Merit: 7410

Crypto Swap Exchange

Quote from: franky1 on December 12, 2023, 03:40:25 PM

Quote from: ABCbits on December 12, 2023, 06:08:27 AM

This is crazy considering many altcoin has it's own NFT protocol and Monero supposed to offer fungibility.

ordinals doesnt work as a proof of transfer thing so it doesnt matter what type of blockchain they chuck junk on..
the junk data does not ON BLOCKCHAIN assign itself to a particular output. thus it doesnt transfer economically.
the scam/empty promise is how ordinals software makes ASSUMPTIONS not locked to block data but software policy, policy they can change without affecting/editing/breaking the blockchain.. yep they can change ownership to a different output with a couple lines of code and completely change who owns what and they dont need to break the blockchain to do it.. so its not a solid proof of transfer. its a scammy lame/ assumption without a security method of real immutable proof

And as i said previously, people who own ordinals generally don't care how "ownership" works. Few of them even use Ordinals only to store arbitrary data on Bitcoin blockchain. Although in case reference software[1] change how ownership work, people will resort by keep using wallet and website which use old "ownership" system.

Quote from: franky1 on December 12, 2023, 03:40:25 PM

putting ordinals on monero or bitcoin makes no difference.. both are schemes and scams of putting junk on a blockchain and PRETEND people get to claim rightful ownership when sold.. even if the proof of transfer does not operate via blockchain proofs, because ordinals does not use/need onchain proof of which output/account owns it.. its all dodgy editable policy in ordinals software

Although Monero community took Ordinals problem seriously by adding limit size on TX_EXTRA[2].

[1] https://github.com/ordinals/ord
[2] https://github.com/monero-project/monero/pull/8733

franky1

legendary

Activity: 4186

Merit: 4385

Quote from: ABCbits on December 12, 2023, 06:08:27 AM

This is crazy considering many altcoin has it's own NFT protocol and Monero supposed to offer fungibility.

ordinals doesnt work as a proof of transfer thing so it doesnt matter what type of blockchain they chuck junk on..
the junk data does not ON BLOCKCHAIN assign itself to a particular output. thus it doesnt transfer economically.
the scam/empty promise is how ordinals software makes ASSUMPTIONS not locked to block data but software policy, policy they can change without affecting/editing/breaking the blockchain.. yep they can change ownership to a different output with a couple lines of code and completely change who owns what and they dont need to break the blockchain to do it.. so its not a solid proof of transfer. its a scammy lame/ assumption without a security method of real immutable proof

putting ordinals on monero or bitcoin makes no difference.. both are schemes and scams of putting junk on a blockchain and PRETEND people get to claim rightful ownership when sold.. even if the proof of transfer does not operate via blockchain proofs, because ordinals does not use/need onchain proof of which output/account owns it.. its all dodgy editable policy in ordinals software

ABCbits

legendary

Activity: 2856

Merit: 7410

Crypto Swap Exchange

Quote from: nutildah on December 12, 2023, 05:54:20 AM

Quote from: Ultegra134 on December 12, 2023, 05:31:35 AM

I agree that the Ordinals should be placed on an independent blockchain and let them do their thing.

The appeal of ordinals (and inscriptions) is having your data stored in the world's most secure and popular blockchain. Even if its just used as a marketing ploy, that's where the allure lies. There are already tons of other blockchains in which massive amounts of data can be stored. A few of them, such as Arweave, were created exactly for that purpose. Ordinals people don't want to use other blockchains... Well I mean they are now, but they're not as popular.

As with its status as a cryptocurrency, Bitcoin Ordinals are the gold standard for ordinals projects, and thus they will have higher value than ordinals on other chains, which now include:

- Litecoin
- Dogecoin (Doginals)
- Ethereum (Ethscriptions)
- Avalanche
- Solana
- Polygon

and most recently,

- Monero (Mordinals... believe it or not, its a thing now Cheesy

)

This is crazy considering many altcoin has it's own NFT protocol and Monero supposed to offer fungibility.

nutildah

legendary

Activity: 2940

Merit: 7892

Quote from: Ultegra134 on December 12, 2023, 05:31:35 AM

I agree that the Ordinals should be placed on an independent blockchain and let them do their thing.

The appeal of ordinals (and inscriptions) is having your data stored in the world's most secure and popular blockchain. Even if its just used as a marketing ploy, that's where the allure lies. There are already tons of other blockchains in which massive amounts of data can be stored. A few of them, such as Arweave, were created exactly for that purpose. Ordinals people don't want to use other blockchains... Well I mean they are now, but they're not as popular.

As with its status as a cryptocurrency, Bitcoin Ordinals are the gold standard for ordinals projects, and thus they will have higher value than ordinals on other chains, which now include:

- Litecoin
- Dogecoin (Doginals)
- Ethereum (Ethscriptions)
- Avalanche
- Solana
- Polygon

and most recently,

- Monero (Mordinals... believe it or not, its a thing now Cheesy

)

Ultegra134

hero member

Activity: 1540

Merit: 744

Quote from: nelson4lov on December 10, 2023, 06:44:32 PM

Bitcoin Developers should just have a hard fork and put Ordinals on their own chain. It's clear that Ordinals will only cause more problems in the future as interest in Ordinals will only continue to go up. The narrative right now is that Ordinals are the next rated Bitcoin and anyone who missed out on Bitcoin would want to join the bandwagon. In the long run, these $20 fees will only chase people from using Bitcoin. Transaction fees will only go up from here if that vulnerability isn't fixed.

$100 transaction fees incoming.

I agree that the Ordinals should be placed on an independent blockchain and let them do their thing. Waiting for people's interest to die down seems quite helpless and meaningless, as numerous new tokens keep popping up every single day and congest the network, hurting Bitcoin and its users in the process. Most of them, if not all of them, have zero purpose and are simply pump-and-dump schemes, which is the very reason the interest in them isn't just going to disappear tomorrow. This is only the beginning; if no action is taken against them, I'm positive that fees will only increase from now on.

So far, no action against them has been taken; all I've seen are a few disclosures stating that they're indeed a vulnerability and steps will be taken to solve the on-going issue, but nothing concrete yet.

ABCbits

legendary

Activity: 2856

Merit: 7410

Crypto Swap Exchange

Quote from: nutildah on December 12, 2023, 04:57:40 AM

--snip--
Interesting that the vulnerability was assigned a "medium" score of 53. Not low, not high, right in the middle. I wonder who assesses these kinds of things -- its not easy to tell from the article. In any case, I think they got it right. Blockchain bloat is indeed a problem, but as data storage solutions continue to improve, how big of a problem will it actually be in the future?
--snip--

You got me curious, so i did quick research and here's the short result.
1. https://nvd.nist.gov/vuln/detail/CVE-2023-50428 mention it use CVSS Version 3.X as way to give score 5.3.
2. https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2023-50428&vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L&version=3.1&source=NIST mention CVSS Version 3.0 and 3.1 give same score and details with only following detail,

Quote from: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2023-50428&vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L&version=3.1&source=NIST

Impact Subscore: 1.4
Exploitability Subscore: 3.9

3. Since NIST website lack some detail, i decide to look on different website and found https://www.opencve.io/cve/CVE-2023-50428 which specify more detail (see my screenshot on below).

NotATether

legendary

Activity: 1568

Merit: 6660

bitcoincleanup.com / bitmixlist.org

I'll tell you something, I never liked the abuse of Ordinals, but I did not expect it to be classified as a vulnerability Grin

Quote from: nutildah on December 12, 2023, 04:57:40 AM

Interesting that the vulnerability was assigned a "medium" score of 53. Not low, not high, right in the middle. I wonder who assesses these kinds of things -- its not easy to tell from the article. In any case, I think they got it right. Blockchain bloat is indeed a problem, but as data storage solutions continue to improve, how big of a problem will it actually be in the future?

I do understand that, ideally in principle, block space should be reserved for actual transactional data, but I think the point remains.

I wonder *who* submitted the vulnerability then. Because Luke is as anti-Ordinals as you can get around these parts.

My guess it's a security researcher who routinely audits Bitcoin Core for vulnerabilities and is against Ordinals.

nutildah

legendary

Activity: 2940

Merit: 7892

Luke denied writing the CVE a few hours ago:

https://cointelegraph.com/news/bitcoin-developer-luke-dashjr-denies-adding-inscriptions-nvd-vulnerability-score

Quote

Bitcoin core developer Luke Dashjr has denied playing any part in adding Bitcoin inscriptions as a cybersecurity risk on the United States National Vulnerability Database’s (NVD) Common Vulnerabilities and Exposure (CVE) list.

Dashjr courted controversy in a Dec. 6 post to X (formerly Twitter) claiming that inscriptions — used by the Ordinals protocol and BRC-20 creators to embed data on satoshis — exploit a Bitcoin Core vulnerability to “spam the blockchain.”

Some observers then pointed to Dashjr days later, when Bitcoin inscriptions appeared on the U.S. vulnerability database as part of the CVE list on Dec. 9, which described it as a security flaw that enabled the development of the Ordinals protocol in 2022.

However, despite being an outspoken Bitcoin Ordinals critic, Dashjr told Cointelegraph that he had no role in adding inscriptions to the vulnerability database’s CVE list.

Interesting that the vulnerability was assigned a "medium" score of 53. Not low, not high, right in the middle. I wonder who assesses these kinds of things -- its not easy to tell from the article. In any case, I think they got it right. Blockchain bloat is indeed a problem, but as data storage solutions continue to improve, how big of a problem will it actually be in the future?

I do understand that, ideally in principle, block space should be reserved for actual transactional data, but I think the point remains.

cmpeq

copper member

Activity: 33

Merit: 152

The solution to this without causing a community rift is simple. Add an OP code which allows verification of a succinct zero knowledge proving system like groth16 (same footprint as a 3 party multisig, ~200-300 bytes) and move forward the proposals for recursive covenants. Then all of the "spam" that some people don't like goes to layer 2 zkVMs, transaction fees come down to normal and everyone is happy.

nelson4lov

hero member

Activity: 2030

Merit: 789

Top Crypto Casino

Bitcoin Developers should just have a hard fork and put Ordinals on their own chain. It's clear that Ordinals will only cause more problems in the future as interest in Ordinals will only continue to go up. The narrative right now is that Ordinals are the next rated Bitcoin and anyone who missed out on Bitcoin would want to join the bandwagon. In the long run, these $20 fees will only chase people from using Bitcoin. Transaction fees will only go up from here if that vulnerability isn't fixed.

$100 transaction fees incoming.

Faisal2202

sr. member

Activity: 1064

Merit: 437

#SWGT CERTIK Audited

You are right OP, this issue of ordinals is being considered by the Developers and they plan to solve this by the 27th update, I got know about it in Finally Bitcoin Devolpers planning to kill Ordinals and Inscription by Gladitorcomeback. This tells us all that they are planning to kill the ordinals and it will solve all the congestion problems, well I thought they might not consider it solving even after announcing it. But your topics indicates that a step has been taken.

Well, this is really bad for those who invested in Ordinal tokens (BRC-20), even when this news was published the price of ORDI token was decreasing but now increasing again, although I never liked Ordinals in the first place, when this issue arises I made some topic about it that's when I get to know that these are not good and judged them as bad use of BTC blockchain (I am good at judging).

electronicash

legendary

Activity: 3066

Merit: 1049

Eloncoin.org - Mars, here we come!

won't this cause a fork since there are also people who supported ordinals?

more than $20 for a transaction fee is too much and you already throw the division on bigger blocks and the non-supporters of it. they would either see it as a feature.
and miners due to the incentive will not mind the ordinals. the more it exists, the higher the profits to get.

alani123

legendary

Activity: 2394

Merit: 1411

Leading Crypto Sports Betting & Casino Platform

Quote from: stompix on December 10, 2023, 12:43:21 PM

Quote from: alani123 on December 10, 2023, 12:32:18 PM

Quote from: stompix on December 10, 2023, 12:27:40 PM

By your definition Gmail limit of 25 MB per attachment is also a vulnerability.

Nice analogy. Let's bring it to the same terms as ordinals function.
So each email has a 25MB limit for attachments.

Yeah, start with the fact that is was 100kb when I got my first computer. Wink

You see, things evolve, things are knot forever stuck in the stone age!

Okie dokie then.
Are you for bigger blocks also?

Certainly today's bandwidth capacity and hard disk prices would permit such. And I am saying that in all honesty.
Bigger blocks could very well help with network congestion and still leave some space for stuff like ordinals.
So if we want to allow JPEGs on the Bitcoin Blockchain, might as well make more space for them instead of just allowing them while space is so limited and they cause so many issues.

stompix

legendary

Activity: 2828

Merit: 6108

Jambler.io

Quote from: alani123 on December 10, 2023, 12:32:18 PM

Quote from: stompix on December 10, 2023, 12:27:40 PM

By your definition Gmail limit of 25 MB per attachment is also a vulnerability.

Nice analogy. Let's bring it to the same terms as ordinals function.
So each email has a 25MB limit for attachments.

Yeah, start with the fact that is was 100kb when I got my first computer. Wink

You see, things evolve, things are not forever stuck in the stone age!
Unless you think what Satoshi did is some sort or act of God that should not be touched!

alani123

legendary

Activity: 2394

Merit: 1411

Leading Crypto Sports Betting & Casino Platform

Quote from: stompix on December 10, 2023, 12:27:40 PM

By your definition Gmail limit of 25 MB per attachment is also a vulnerability.

Nice analogy. Let's bring it to the same terms as ordinals function.
So each email has a 25MB limit for attachments.
But let's say someone finds a special string of text that if included to an email, can allow for unlimited bundles of 25MB attachments, essentially allowing for unlimited storage per email.

Of course, Google would want to limit what this string of text allows for, because this was never part of intended functionality and therefore is classified as a vulnerability that needs to be patched.

stompix

legendary

Activity: 2828

Merit: 6108

Jambler.io

Quote from: alani123 on December 10, 2023, 08:07:57 AM

Quote from: stompix on December 10, 2023, 07:51:42 AM

What part of this you don't understand?

Quote

This vulnerability has been received by the NVD and has not been analyzed.

What I don't understand is why everything has to be about Luke. Even when the man does something right, people come after him with such hatred.

Because he is the one modifying the wiki on his own and then filling a vulnerability claim by citing his own modified links?

Assume I modify the wiki by claiming alani123 is the true mastermind behind the bitfinex hack and I claim I have the proof but don't show it and just quote another blog own by myself in which again I accused you of doing so!
Does this count being about the hack, about bitfinex or about someone who just wants to push his agenda? Guess where Luke is in this?

https://nvd.nist.gov/vuln/detail/CVE-2023-50428#VulnChangeHistorySection
References:
https://twitter.com/LukeDashjr/status/1732204937466032285

Muhahahahahha

Quote from: alani123 on December 10, 2023, 08:07:57 AM

Got to love the guy don't you?

How but it seems that your love for this guy goes so deep to the point that maybe it stops smelling like s*** and starts tasting like chocolate! I wouldn't know, never made idols out of deranged individuals.
Maybe he should fix the thing that makes all bitcoins insecure first, right?
https://twitter.com/hodlonaut/status/1615033789956202496

Quote from: alani123 on December 10, 2023, 08:07:57 AM

Using holes in the code to exploit it counts as a vulnerability by definition.

You have no idea what a hole in a code is, right?
By your definition Gmail limit of 25 MB per attachment is also a vulnerability.

franky1

legendary

Activity: 4186

Merit: 4385

Quote from: pooya87 on December 10, 2023, 08:05:05 AM

Quote from: franky1 on December 10, 2023, 02:25:21 AM

they wont do anything because the CVE did not cater to describing all of the subclass of opcodes that allow validation bypasses

If you are talking about OP_SUCCESS that bypasses validation, it is non-standard already so nodes never relayed such transactions from the start.

if you look at the github conversations. there is alot of "whatabout"ism's
"what about using op_true"
basically saying making op_false become conditional or disabled will just push ordinal junkers to just use a different opcode, as the excuse to do nothing at all about the problem
heck even the unconditioned op_success class of codes.
"what about if they pushTX direct to mining pool"

elkeppy

newbie

Activity: 2

Merit: 0

I believe in the self-regulation of free markets, and in my opinion the long-term benefit of NFTs and ordinals for users is still questionable. However, let's consider a hypothetical scenario where there has not yet been a way to arbitrarily describe blockchain storage space: What if there was an idea to "rent out" blockchain storage space for arbitrary, non-transactional data?

In my opinion, Bitcoin does not need such a function. If it did, the usefulness of the Lightning Layer would be called into question. The Lightning Network was created to facilitate faster and more efficient Bitcoin transactions, which suggests that the main layer is not ideally equipped to handle a large volume of transactions. So if we suddenly have plenty of room for non-Bitcoin data on the blockchain, it would mean that we also have enough capacity to process all payments on the main layer, which does not seem to be the case currently or as the network's user base grows.

This raises an interesting question about the future direction of Bitcoin and its blockchain. I would be surprised if the majority is in favor of making Bitcoin a decentralized storage location on the main layer.

Shishir99

sr. member

Activity: 630

Merit: 374

I do not understand these things as I am not a coder, nor anyone who understands basic programming. But I would love to see devs come to a solution where shit coins won't be able to use Bitcoin protocol to create spam and scam tokens. That ORDI thing destroyed Bitcoiner's life and people doubting about using BTC now because of the network congestion.

The people are miners who made some profit from these recent developments. People who were thinking of using or adopting BTC are unlikely to use it if they see that they need to spend a $10 fee to transfer $50 worth of Bitcoin.

alani123

legendary

Activity: 2394

Merit: 1411

Leading Crypto Sports Betting & Casino Platform

Quote from: stompix on December 10, 2023, 07:51:42 AM

What part of this you don't understand?

Quote

This vulnerability has been received by the NVD and has not been analyzed.

What I don't understand is why everything has to be about Luke. Even when the man does something right, people come after him with such hatred. Got to love the guy don't you? Cheesy

Using holes in the code to exploit it counts as a vulnerability by definition. If Luke is actually trying to fix this he deserves recognition.

Quote from: Artemis3 on December 10, 2023, 07:57:05 AM

Quote from: alani123 on December 09, 2023, 11:56:04 PM

CVE-2023-50428

Quote

In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code (e.g., with OP_FALSE OP_IF), as exploited in the wild by Inscriptions in 2022 and 2023.

Via: https://nvd.nist.gov/vuln/detail/CVE-2023-50428

Good to see this issue finally receiving some attention. Hopefully abuse of this vulnerability in bitcoin's code will be addressed soon. What are your thoughts on the matter?

Wow it took a whole year for it to be properly filled after being publicly demonstrated by Ordinals and the others that followed. There is still hope...

It's definitely weird how long this took. For sure certain devs were stalling and some just didn't pay attention. We have to be thankful that this issue is brought up again because it affects every Bitcoin user very negatively.

pooya87

legendary

Activity: 3430

Merit: 10505

Quote from: franky1 on December 10, 2023, 02:25:21 AM

they wont do anything because the CVE did not cater to describing all of the subclass of opcodes that allow validation bypasses

If you are talking about OP_SUCCESS that bypasses validation, it is non-standard already so nodes never relayed such transactions from the start.

Artemis3

legendary

Activity: 1988

Merit: 1561

CLEAN non GPL infringing code made in Rust lang

Quote from: alani123 on December 09, 2023, 11:56:04 PM

CVE-2023-50428

Quote

In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code (e.g., with OP_FALSE OP_IF), as exploited in the wild by Inscriptions in 2022 and 2023.

Via: https://nvd.nist.gov/vuln/detail/CVE-2023-50428

Good to see this issue finally receiving some attention. Hopefully abuse of this vulnerability in bitcoin's code will be addressed soon. What are your thoughts on the matter?

Wow it took a whole year for it to be properly filled after being publicly demonstrated by Ordinals and the others that followed. There is still hope...

stompix

legendary

Activity: 2828

Merit: 6108

Jambler.io

Quote from: alani123 on December 10, 2023, 07:38:07 AM

Doesn't mean that the vulnerability isn't there though.

Yes it does!
I can report OP_CLTV as vulnerability, does it make it one?

What part of this you don't understand?

Quote

This vulnerability has been received by the NVD and has not been analyzed.

alani123

legendary

Activity: 2394

Merit: 1411

Leading Crypto Sports Betting & Casino Platform

I am not sure who contributed to the CVE entry, might have been Luke.
Doesn't mean that the vulnerability isn't there though.

It's a real issue and needs to be addressed appropriately as with any exploit in bitcoin's code.

stompix

legendary

Activity: 2828

Merit: 6108

Jambler.io

Quote from: alani123 on December 09, 2023, 11:56:04 PM

Good to see this issue finally receiving some attention.

By attention you mean that Luke has edited the Bitcoin wiki on its own and sent it as a reference along his GitHub to Nist claiming it's a vulnerability?

Quote

This vulnerability has been received by the NVD and has not been analyzed.

&
https://en.bitcoin.it/w/index.php?title=Common_Vulnerabilities_and_Exposures&action=history

ABCbits

legendary

Activity: 2856

Merit: 7410

Crypto Swap Exchange

Quote from: alani123 on December 09, 2023, 11:56:04 PM

Hopefully abuse of this vulnerability in bitcoin's code will be addressed soon. What are your thoughts on the matter?

I have doubt Bitcoin Core developer would fix it after looking for reference discussion[1]. And even if they do, it's only somewhat effective after majority node owner update their software.

[1] https://github.com/bitcoin/bitcoin/pull/28408

alani123

legendary

Activity: 2394

Merit: 1411

Leading Crypto Sports Betting & Casino Platform

Quote from: franky1 on December 10, 2023, 02:25:21 AM

the CVE thing got a little too specific by mentioning just a couple opcodes...
the thing is there a large group of unconditioned opcodes that are treated as valid without checking the content after the opcode.. so core dev github comments are not addressing the issue and instead are just playing 'buzzword whataboutisms' by saying
'but what about if they use [insert buzzword] opcode'

they wont do anything because the CVE did not cater to describing all of the subclass of opcodes that allow validation bypasses

the easy solution is
a. any opcode that does not have any formatting data content requirement (that uses isvalid) disable it
or
b. fee rate that particular transaction using such opcodes as requiring 1000x 'fee estimate' else treat as dust and dont relay/add to block

and yes code can be made to do this. and yes it can be enforced... well if devs decide to be devs and not 'we cant do it' echoers

There were two op codes mentioned as examples, but otherwise the unlimited data being added to transactions is mentioned as an exploit. Arguably the CVE is a little too broad. But there's certainly potential solutions. The point is to actually get the devs to do something. The only supporters of unlimited data in transactions that I see for now are the ones that keep exploiting this issue to upload images of cats on bitcoins Blockchain to make their "NFTs", the rest know that it was an unforseen consequence of recent updates. Getting it fixed makes sense for every normal Bitcoin user that needs to use block space to transact cash value.

riverdip

jr. member

Activity: 198

Merit: 2

i always hated Ordinals

franky1

legendary

Activity: 4186

Merit: 4385

the CVE thing got a little too specific by mentioning just a couple opcodes...
the thing is there a large group of unconditioned opcodes that are treated as valid without checking the content after the opcode.. so core dev github comments are not addressing the issue and instead are just playing 'buzzword whataboutisms' by saying
'but what about if they use [insert buzzword] opcode'

they wont do anything because the CVE did not cater to describing all of the subclass of opcodes that allow validation bypasses

the easy solution is
a. any opcode that does not have any formatting data content requirement (that uses isvalid) disable it
or
b. fee rate that particular transaction using such opcodes as requiring 1000x 'fee estimate' else treat as dust and dont relay/add to block

and yes code can be made to do this. and yes it can be enforced... well if devs decide to be devs and not 'we cant do it' echoers

wallet4bitcoin

sr. member

Activity: 896

Merit: 279

I can't say fro sure what Ordinals actually targets at except for cheap fame. There are ways around it than clustering the network with their own 'economically incentivised' transactions for miners.

Bitcoin has served and is still serving and still will even after now, if any vulneraility is spotted, it should be addresses asap and not exploited.
Addressing a blockchian vulnerability should make you feel valuable to have contributed imensely to a great feat but they chose the other way round and I totally detest it.

Now they are the verge of lossing some value as Bitcoin developers are hoping to fix the vulnerability.

pinggoki

sr. member

Activity: 1442

Merit: 390

★Bitvest.io★ Play Plinko or Invest!

I say that the devs fix this vulnerability so the people won't needlessly suffer from high tx fees caused by ordinals. Besides hoping for the fix in the vulnerability, I do hope too that the miners wouldn't mind having this vulnerability fixed, they've got it going while it's still good so why prolong it and just have them all the benefits of bitcoin right?

alani123

legendary

Activity: 2394

Merit: 1411

Leading Crypto Sports Betting & Casino Platform

CVE-2023-50428

Quote

In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code (e.g., with OP_FALSE OP_IF), as exploited in the wild by Inscriptions in 2022 and 2023.

Via: https://nvd.nist.gov/vuln/detail/CVE-2023-50428

Good to see this issue finally receiving some attention. Hopefully abuse of this vulnerability in bitcoin's code will be addressed soon. What are your thoughts on the matter?

Topic: Vulnerability that allowed Ordinals to exist now has its own CVE code (Read 324 times)