BitcoinCrypto

Bitcoin Optech Newsletter #429

Read full article at source ↗

Based on a feed excerpt; full article content has not been acquired. Source evidence retrieved 30/10/2026, 11:07:24 UTC.

Briefings

Bitcoin Core released a security policy backporting fixes for three newly discovered vulnerabilities, addressing a surge in reports of easily discoverable bugs. The newsletter also details a protocol for silent multiparty payments using AggDLEQ proofs and a critical CLN self-referential channel DoS vulnerability where nodes accepted identical node IDs in announcements, causing crashes on restart. Security experts from Bitcoin Stack Exchange explained why Bitcoin uses both transaction and witness IDs to prevent chain malleability and denial-of-service attacks.

Key points

• Bitcoin Core backported fixes for three newly discovered vulnerabilities classified as easily discoverable, with the fixes merged after tag 32.0 and shipped in version 32.1 alongside other point releases.
• A protocol for silent multiparty payments using AggDLEQ proofs was proposed by Oleksandr Kurbatov, relying on two rounds of messages between signers and a coordinator without requiring new PSBT fields or security proofs.

Context

Bitcoin Core released a security policy backporting fixes for three newly discovered vulnerabilities classified as easily discoverable, with the fixes merged after tag 32.0 and shipped in version 32.1 alongside other point releases. A protocol for silent multiparty payments using AggDLEQ proofs was proposed by Oleksandr Kurbatov, relying on two rounds of messages between signers and a coordinator without requiring new PSBT fields or security proofs.

Limitations

The security policy update notes that the three vulnerabilities were disclosed under the new classification, but the specific nature of the 'open question' assumption regarding corrupted signers and the coordinator remains unverified. The AggDLEQ protocol's security proof relies on an assumption whose hardness is currently an open question, and the CLN vulnerability was found via gossip fuzzing later proposed in Core Lightning #9115, with the fix applied in CLN 26.04.1.

Generated by Bittrees-hosted qwen35-2b sha256:aaf42c8b7c3c on 09/11/2026, 03:46:03 UTC. Based on publisher-provided feed evidence; may not cover the full original article. Check the source for details.

View archived briefing on IPFS
bafybeig7gxaohjf2wsxlllpxwnpgpexnaueudv6iztctpwwaqhf6z5fqje