PT-2024-25929 · Btcd · Btcd

Dergoegge · Published 2024-05-04 · Updated 2025-08-21 · CVE-2024-34478

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions btcd versions prior to 0.24.0

Description The issue arises from an incorrect implementation of the consensus rules outlined in BIP 68 and BIP 112, making btcd susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. This can lead to a chain split and loss of funds.

Recommendations For versions prior to 0.24.0, update to version 0.24.0 or later to resolve the issue. As a temporary workaround, consider restricting transactions that may trigger the incorrect consensus rule implementation until a patch is applied.

Fix

Weakness Enumeration

CWE-436

Related Identifiers

CVE-2024-34478

GHSA-3JGF-R68H-XFQM

GO-2024-2818

Affected Products

Btcd

References · 16

• https://osv.dev/vulnerability/GO-2024-2818 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34478 · Security Note
• https://osv.dev/vulnerability/GHSA-3jgf-r68h-xfqm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-34478 · Vendor Advisory
• https://github.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/txscript/opcode.go#L1172C1-L1178C3 · Note
• https://github.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/blockchain/chain.go#L383C1-L392C3 · Note
• https://github.com/btcsuite/btcd/commit/253b688c68b89eca7eb75d4d5443dbdbc928db3c · Note
• https://github.com/btcsuite/btcd/pull/1981 · Note
• https://github.com/btcsuite/btcd · Note
• https://t.me/cvenotify/79121 · Telegram Post
• https://twitter.com/CVEnew/status/1787139417708061100 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1786995452518203701 · Twitter Post
• https://t.me/cveNotify/133012 · Telegram Post
• https://twitter.com/geeknik/status/1789736509668458857 · Twitter Post
• https://delvingbitcoin.org/t/disclosure-btcd-consensus-bugs-due-to-usage-of-signed-transaction-version/455 · Note