BCH Backer Claims Bitcoin Wallet Double-Spend Issue Hasnâ€™t Been Fixed
BRD, Ledger Live, and Edge are among the wallets vulnerable to a new double-spend exploit, but some believe the vulnerability is inherent to Bitcoin itself.
On July 2, crypto security firm ZenGo identified a double-spend exploit targeting several popular Bitcoin (BTC) wallets, dubbed â€˜BigSpenderâ€™
Of nine cryptocurrency wallets tested by ZenGo, BRD, Ledger Live, and Edge were found to have been vulnerable to the attack. The three companies updated their products after ZenGo notified them of the threat, however the firm warned that â€œmillionsâ€� of crypto users may have been exposed to the exploit prior to its identification.
Despite the walletsâ€™ move to protect against BigSpender, Bitcoin Cash (BCH) proponent Hayden Otto claims the vulnerability is inherent to Bitcoin â€œby designâ€� and can still be exploited.
BigSpender was discovered through ZenGoâ€™s ongoing research into Bitcoinâ€™s â€˜Replace-by-Feeâ€™ (RBF) feature.Â
According to the security firm, â€œRBF is a standard method to allow users to â€˜undoâ€™ a yet to be confirmed transaction, by sending another transaction spending the same coins (but possibly different destination) with a higher feeâ€�.
BigSpender is not the first time an exploit has targeted RBF vulnerabilities to execute a double-spend attack, with a similar technique being notoriously outlined in a video published by Otto in December that quickly went viral. The exploit is only possible with zero confirmations.
Speaking to Cointelegraph, Otto stated that RBF attack’s are â€œparticularly concerning for BTC-accepting merchants who could have easily handed over goods to a customer who then reversed their BTC transaction upon leaving the store.â€�
â€œThe technique is facilitated by RBF (replace by fee), a so-called â€˜featureâ€™ added at the protocol level by the Bitcoin Core developers.The issue exists if you use BTC. Wallet software can only make some trade off, which results in a worse BTC user experience, in order to try to protect BTC users.â€�
The BCH proponent described the exploit as â€œan issue with BTC itself,â€� adding that it has â€œnothing to do with the various wallet softwareâ€�.
Wallets challenge severity of threat
However, not everyone is convinced that BigSpender comprises a grave threat to Bitcoin, with the affected wallet providers challenging the language employed by ZenGoâ€™s researchers.
Speaking to Forbes: Ledger asserted: â€œThere is no actual double-spend being performed. The user funds stay safe. Nevertheless, the display of received transactions could be misleading.â€�
This is of course, what Otto exploited: getting merchants to hand over the goods before the funds were transferred due to a â€œmisleadingâ€� display. However, merchants who wait for transactions to be confirmed before sending goods do not risk being affected.
ZenGo has released a free open-source tool that allows wallet providers to test their products and secure against the BigSpender vulnerability. The firm noted that not all of the wallets affected by the exploit have implemented upgrades
Powered by WPeMatico