Bitcoin Wallets are vulnerable to double spend - Coindesk

[Juggy777]

According to Coindesk article (link below) the following wallets are vulnerable to double spending, and can be exploited by hackers.

The firm tested nine different wallets including Ledger Live, Trust wallet, Exodus, Edge, Bread, Coinbase, Blockstream Green, Blockchain and Atomic Wallet. Of those tested, three were found to be vulnerable to the theoretical exploit.

It’s also pertinent to note that they have tested only nine wallets, but have claimed that the other wallets too could be at risk. What do you’ll think about their claims, are these wallets actually at risk or it’s an attempt to promote their own wallet?.

A standard way to transact Bitcoin could be vulnerable to double-spending, new research has found. Blockchain sleuths at ZenGo, a wallet startup, have found a vulnerability that affected at least three major crypto wallets – Ledger Live, Edge and Breadwallet (BRD) – and potentially more.

Source:

https://www.coindesk.com/researchers-expose-flaw-in-bitcoin-wallets-that-could-be-exploited-for-double-spending

[1714864789]

1714864789

[1714864789]

1714864789

[1714864789]

1714864789

[akhjob]

The article itself states that this is not a double-spend vulnerability as mentioned by ZenGo, but a Wallet's design flaw which has to be rectified as some noobs might fall for it.

“You have to decide what is the definition of a double-spend. Most people that aren’t trolls would say that a double-spend is when you have a confirmed transaction that is somehow invalidated and spent with a different confirmed transaction,” Jameson Lopp, CTO of custody startup Casa, said, denying the researchers’ claims.

 

[20kevin20]

I'm quite sure that even if you have some balance in your account showing up through a glitch, you can't really spend it as the network would not allow that to happen. It's not as if a hacker could create a modified version of Electrum to allow double spending - if that was the case, there would've been way more BTC around than we currently have and the coin would've already been dead anyway.

I understand CoinDesk might need fancy article titles for clickbait, but this one honestly sucks. It makes those who've never researched about BTC think double-spending is now a thing through wallet vulnerabilities.

[DdmrDdmr]

Ledger has indeed already come-up with a solution, and Ledger Live 2.7.0 is available for download (from Ledger Live itself):

We’ve implemented a message in Ledger Live to appear near your balance whenever you have any incoming unconfirmed transactions. This way, you’ll be informed whenever there’s a transaction waiting to be confirmed still. Aside from this UX enhancement, we also fine-tuned the UX relating to RBF-cancelled transactions. While creating a Bitcoin transaction, Ledger Live will now no longer let unconfirmed transactions be used for new transactions by default. This will ensure that you won’t be facing any difficulties with the “Send Max” feature – even if any pending incoming transactions are cancelled. This setting can be changed if desired.

https://www.ledger.com/trickery-is-not-a-vulnerability

It does seem like something that could have been foreseen and handled proactively and not reactively (I mean highlinghting received unconfirmed TXs a tad).

[Charles-Tim]

While real with cryptocurrencies, we need to be careful, all processes to knowing a transaction is not only propagated into the blockchain but also has been confirmed should be done, checking this on your wallet (I mean the complete confirmation) and also using the blockchain explorer will be good.

Transaction with zero confirmation can normally be reversed also transactions that have not been completely confirmed can possibly be swapped by replacing/increasing the fee to divert the transactions to another wallet. Even if this has not happened to anyone of us before, we should be careful for not to be a victim.

We should only believe in transactions that has been mined.

I'm quite sure that even if you have some balance in your account showing up through a glitch, you can't really spend it as the network would not allow that to happen. It's not as if a hacker could create a modified version of Electrum to allow double spending - if that was the case, there would've been way more BTC around than we currently have and the coin would've already been dead anyway.

The double spending here talked about here is different, this one happens in a way someone can send you bitcoin making you to believe the transaction has been or will be successful but not yet been mined, the person will use higher fee to easily swap the bitcoin to another wallet, which means the person double spend the bitcoin. This does not affect the total number of bitcoin in circulation.

As copied from the link above: https://www.coindesk.com/researchers-expose-flaw-in-bitcoin-wallets-that-could-be-exploited-for-double-spending
The firm tested nine different wallets including Ledger Live, Trust wallet, Exodus, Edge, Bread, Coinbase, Blockstream Green, Blockchain and Atomic Wallet. Of those tested, three were found to be vulnerable to the theoretical exploit.

Electrum wallet was never listed and out of the wallet listed only 3 were found to have the RBF and DOS vulnerability.

Also copied from the link: https://www.coindesk.com/researchers-expose-flaw-in-bitcoin-wallets-that-could-be-exploited-for-double-spending
We have not tested all the wallets but it could be that if three of the largest are implicated, more out there are too,” Ohayon said. ZenGo alerted the firms about its findings, and gave them 90 days to repair the vulnerability.

Ledger and BRD have released code changes to prevent the attack from happening, and paid undisclosed bug bounties to ZenGo, while Edge is currently undergoing a “significant refactor” that will address the issue, Edge’s CEO Paul Puey said in an email.

If not true, while ledger and bread wallet have so far response about it.

The worst part of is that it is also reported this type of attack can disabled wallet completely with the knowledge of the wallet owner

Also copied from the link: https://www.coindesk.com/researchers-expose-flaw-in-bitcoin-wallets-that-could-be-exploited-for-double-spending
However, ZenGo researchers found there is a second order attack, which follows the same scheme outlined above, which could permanently disable a wallet with or without the victim’s knowledge of the transaction.

In this case, the attacker again artificially inflates a victim’s balance by sending repeated transactions to her wallet. This can be done without a victim’s consent. By canceling the transactions before confirmed, the victim’s stated wallet balance and actual funds are again decoupled, making their wallet unusable. Worse, the attack can affect multiple wallets at the same time.

Let us only believe in only transactions that has been mined.

[vapourminer]

Also copied from the link: https://www.coindesk.com/researchers-expose-flaw-in-bitcoin-wallets-that-could-be-exploited-for-double-spending
However, ZenGo researchers found there is a second order attack, which follows the same scheme outlined above, which could permanently disable a wallet with or without the victim’s knowledge of the transaction.

In this case, the attacker again artificially inflates a victim’s balance by sending repeated transactions to her wallet. This can be done without a victim’s consent. By canceling the transactions before confirmed, the victim’s stated wallet balance and actual funds are again decoupled, making their wallet unusable. Worse, the attack can affect multiple wallets at the same time.

a wallet with coin control will (should? correct me if wrong) nullify this second kind of attack. so a coin control capable wallet is still usable in that particular case.

[Charles-Tim]

For example, hardware wallets like ledger nano are commonly used for payment in stores, if the PBF attackers send many compromised transactions, this will only appear on the balance but the bitcoins are not usable, if the usable funds are completely used, the rest which appear in the balance which is unusable makes the wallet useless. The attacker will continuously sending the certain amount of bitcoin and diverting it to another wallet to only tricking the wallet owner thinking he actually have what he does not have but only appearing on his bitcoin balance on the ledger nano wallet.

a wallet with coin control will (should? correct me if wrong) nullify this second kind of attack. so a coin control capable wallet is still usable in that particular case.

If a wallet can function in a way to display on the balance only bitcoin that has all already been mined, this will be a good solution but as for the coin control, I do not know, I am still learning.

Some wallets could work this way and indeed not possible for such replace-by-fee function to trick wallet owners, and the denial of service will not be possible.

It is not actually a trick that can affect people that knows about it. No complete confirmations no service will be good.

[20kevin20]

I'm quite sure that even if you have some balance in your account showing up through a glitch, you can't really spend it as the network would not allow that to happen. It's not as if a hacker could create a modified version of Electrum to allow double spending - if that was the case, there would've been way more BTC around than we currently have and the coin would've already been dead anyway.

The double spending here talked about here is different, this one happens in a way someone can send you bitcoin making you to believe the transaction has been or will be successful but not yet mined or fully mined, the person will use higher fee to easily swap the bitcoin to another wallet, which means the person double spend the bitcoin. This does not affect the total number of bitcoin in circulation.

Yeah, I understood what the article talked about, this is basically how double spending works.

But to the average person the article makes it sound like Bitcoin can be double spend as in you can validate 2 txs using the exact same coins, as if the network itself is flawed. It's basically just a wallet glitch (later edit: it's not even a glitch! it's just that some people may get confused and think that a recevied amount of BTC means it's already confirmed, which is literally lack of knowledge.. seen at newbies) and the simplest way you can avoid it is by checking if the tx has been confirmed yet or not. If the tx hasn't been confirmed, it means the received coins aren't valid yet.

I'm not 100% sure if this could be another "fix" but my Live shows on the left side of the transactions a circle with an icon (to differentiate sent from received amounts). When the circle is filled, I know it's a confirmed tx so I can't really be deceived. Any empty circle means the tx hasn't been confirmed.

So as the article @DdmrDdmr mentioned says, it’s not a vulnerability, but instead a clever piece of social engineering where a malicious actor would try to trick you. Only complete newbies would probably fall for such a trick.

[khaled0111]

a wallet with coin control will (should? correct me if wrong) nullify this second kind of attack. so a coin control capable wallet is still usable in that particular case.

You are right about this. You can use coin control feature to spend only transactions that have been confirmed but the only inconvenience is that sometimes there are too many transactions (confirmed +unconfirmed) and it becomes impractical to browse the whole list.
A more practical solution would be to disable "spend unconfirmed" option which is available on most wallets.

[pooya87]

the article starts with a big nonsense:

The bug, which the Tel Aviv-based firm calls BigSpender, allows a hacker to double-spend a user’s funds and possibly prevent them from ever using their wallet again.

no matter how the wallet handles (un)confirmed transactions no "hacker" can spend "user's" funds. what the attacker can double spend is their own funds that are still unconfirmed.