Brink, the Bitcoin improvement group, not too long ago funded the primary ever unbiased safety audit of Bitcoin Core carried out by a 3rd celebration (the complete report is obtainable right here). The audit was carried out by Quarkslab, a software program safety agency, with the assistance of the Open Supply Know-how Enchancment Fund (OSTIF) and collaboration with Bitcoin Core builders Niklas Gögge, from Brink, and Antoine Poinsot, from Chaincode Labs.
This safety audit marks a milestone within the improvement historical past of Bitcoin Core, essentially the most broadly adopted and reference consumer of the Bitcoin community and protocol.
Whereas Bitcoin Core safety insurance policies and practices have been steadily hardened and revised to be extra thorough and complete over the previous couple of years, an exterior audit by a 3rd celebration specialised in safety assessment is a brand new bar to fulfill. It was met.
The audit concerned guide code assessment, static and dynamic evaluation with automated instruments, and superior fuzz testing, which takes robotically generated enter and runs it via totally different code paths making an attempt to disclose surprising or detrimental habits.
No essential, excessive, or medium-severity bugs have been found within the audit. Two low-severity points have been totally different, and 13 different points that aren’t categorised as vulnerabilities below Bitcoin Core’s vulnerability classification standards.
Your complete course of additionally resulted in enhancements in Bitcoin Core’s testing infrastructure, together with new fuzz testing infrastructure for block connection and chain reorganization eventualities, a brand new space to be coated by testing, file system enhancements rushing up and enhancing fuzz testing generally, new utilities for testing again sliding code efficiency, and ideas for enhancing code readability for reviewers and new builders.
A few of these enhancements are already being labored on for eventual assessment and merging into the Bitcoin Core repository.
The outcomes of this unbiased safety audit have strengthened that Bitcoin Core’s enhancements over latest years in safety coverage, testing, and total high quality assessment have had a significant affect on the undertaking.
