Crypto
Home›Crypto›Market Structure›Explainer links Liquid incident to cached validation b…
Explainer links Liquid incident to cached validation bug and peg-out
Researchers say a flaw in Liquid confidential transaction range proof caching may have let invalid L-BTC be redeemed, centered on a Sept. 6 peg-out that produced about 3,996 BTC.
Researchers analyzing the Liquid Network incident, involving roughly $320 million, are pointing to an alleged failure in the software’s transaction-validation cache as a possible mechanism for how unbacked L-BTC could have been redeemed for real Bitcoin, according to CryptoSlate.
The account centers on Liquid’s federation functionaries running code that allegedly contained the exploited bug from Elements’ master development branch the prior week, while other nodes rejected invalid transactions, though the deployment explanation has not been confirmed by Blockstream in available statements.
Liquid is a Bitcoin sidechain where L-BTC tokens are intended to be backed one-for-one by BTC held by its federation. CryptoSlate says SideSwap previously reported that a customer submitted 4,000 L-BTC through a peg-out service on Sept. 6, leading to the release of approximately 3,996 BTC, and that Liquid said neither SideSwap’s peg-out authorization key nor other federation keys had been compromised.
Technically, the researchers describe how range proofs in confidential transactions should help ensure hidden amounts are within an allowed range, preventing a scenario where a crafted hidden negative output offsets a larger positive output. CryptoSlate reports that caching successful range-proof verification results could, in the proposed scenario, allow an invalid proof to bypass a range check if it collides with a cached key, with a separate reconstruction also describing setup transactions followed by an allegedly invalid transaction.
Latest closeBitcoin $79,153.04 ▼1.5%