The cybersecurity company Quarkslab has completed the first public third-party security audit of the Bitcoin core codebase. The Bitcoin core codebase is the open source reference implementation that supports the Bitcoin network, containing the full node client, graphical user interface (GUI), and embedded wallet.
According to the announcement released on Wednesday, this four-month assessment is funded by the non-profit organization Brink, which supports Open Source Bitcoin protocol development, and is coordinated by the Open Source Technology Improvement Fund (OSTIF). The assessment focuses on the peer-to-peer network layer (the main attack surface of the network) as well as related components, including mempool management, chain state, transaction validation, and consensus logic.
The audit was completed in September, taking 100 working days by three Quarkslab engineers, with technical support from Brink and the Bitcoin development company Chaincode Labs. Before the code review began, the two auditors had face-to-face communication with Brink's engineers to familiarize themselves with the architecture and development practices of Bitcoin Core.
This process combines manual code analysis, dynamic testing, and advanced fuzz testing techniques borrowed from the existing continuous integration workflow of Bitcoin. Fuzz testing is an automated software testing technique that attempts to find vulnerabilities by inputting a large amount of unexpected, random, or malformed data into the code.
Brink pointed out in another article that the purpose of this move is not to certify Bitcoin Core, but to “actively search for vulnerabilities, improve testing methods, and find practical ways to strengthen the codebase.”
Quarkslab reported that no serious, high-risk, or medium-severity issues were found. The auditors did identify two low-risk issues and provided 13 informational recommendations, but these issues do not meet the security vulnerability classification standards of Bitcoin Core.
Quarkslab stated: “Although no major impact issues were found, the existing fuzz testing framework and the new framework for covering untested scenarios such as chain reorganization have both been improved.” OSTIF added: “Although this audit found no issues with significant, high-risk, or medium security impacts, it provided valuable feedback, insights, information, and testing improvement suggestions for Bitcoin.” (The Block)
Related Articles
BTC 15-minute drop of 0.45%: spot selling pressure led the move, and leveraged funds stayed on the sidelines, without worsening volatility
Passive BTC Earnings Made Simple: Bitcoin Everlight Phase 5 Shards Now Available for $100
Under the Iran-U.S. conflict, the Bitcoin market is currently splitting: institutions continue to buy, while whales and mining firms are accelerating their sell-offs
CME Bitcoin futures open interest falls to $8.41 billion, hitting a 14-month low
STRC This week’s fundraising is expected to be able to buy 8,000 BTC, or hold 10,000 coins