BLOCKSTREAM’S OWN ASSESSMENT SAYS THE FIX FOR A 2018 BUG CREATED THE BUG THAT MINTED 4,000 UNBACKED COINS — AND THE OFFLINE-KEY BACKSTOP DEPENDED ON THE CHECK THAT FAILED

Blockstream published its full assessment of the Liquid hack on September 23. The order of events in it is the story. An external researcher named stutxo reported a bug in how Liquid’s software cached range proof checks on August 2. Blockstream wrote a fix. The fix is what got exploited on September 6.

The original defect goes back to an April 2018 commit, merged May 30, 2018, in Elements v0.14.1. It left the asset commitment and the locking script out of the cache key, so one verified proof could be reused against a different asset. The August patch put those fields back. It also pasted them into the same hash one after another with nothing marking where each field ended. Two of them are variable length, so an attacker could shift the boundary between them and get two different transactions to land on the same cache key. SlowMist and an independent Bitcoin++ write-up describe the same mistake.

On September 6 someone did exactly that, minted roughly 4,000 L-BTC with no bitcoin behind it, and pegged it out. The federation’s reserve fell from about 4,205 bitcoin to 197. The real repair, Elements PR 1600, runs the fields through CHashWriter, which puts a length in front of each one. Blockstream’s description of what that buys: no sequence of bytes can be read two different ways. It shipped September 9 in Elements v23.3.4.

The part worth sitting with is the backstop. Liquid’s peg-out authorization uses an offline key that controls where bitcoin can go and an online key that controls who can ask for it. Blockstream’s own report says that protection depended on consensus validating correctly that no LBTC can be created without a matching and provably valid transaction. The safety net was tied to the check that broke. When validation waved the bad coins through, the net had nothing left to catch.

Fifteen functionary nodes run Liquid and eleven signatures make a block. Every signature that day was honest. Nobody was bribed and no key was stolen. The functionaries ran the software, the software said the proof was good, and it was not. Bitcoin’s chain did its job the whole time. The peg-out was an ordinary valid bitcoin transaction with real signatures on it. Nothing on the base layer was fooled, because the base layer was never asked. The 4,000 coins were invented one layer up, where a cache stood in for the rule. About 602 bitcoin never came back. At the time of this writing, bitcoin was $84,460.