Security· ★★★· neutral·

Bitcoin Core fix closes PSBT gap that could redirect funds without stealing keys

  • —The fix was merged into Bitcoin Core's master branch on Sept. 25; no release with the fix has shipped yet
  • —The flaw affects legacy and SegWit v0 inputs under SIGHASH_SINGLE with no output at the matching position
  • —Private keys are not exposed, but a signature can stay valid if the recipient is changed
  • —Wallet and hardware signer providers should review their own SIGHASH_SINGLE handling
Why it matters: Wallet and hardware signer providers need to review SIGHASH_SINGLE handling before a release ships, or users could sign a payment to the wrong recipient.
#BTC
Source: CryptoSlate
More on this
DeFi · Sep 16
Bitcoin Core 32 enters final testing: fees, validation and a vulnerability fix
 Security · Sep 27
Hacker drains 3,996 BTC from Liquid sidechain without stealing keys
 DeFi · Oct 2
Onchain Perps Close Execution Gap With CEXs