Quarkslab completes the first public third-party audit of Bitcoin Core: no major vulnerabilities found.

The cybersecurity company Quarkslab has completed the first public third-party security audit of the Bitcoin core codebase. The Bitcoin core codebase is the open source reference implementation that supports the Bitcoin network, containing the full node client, graphical user interface (GUI), and embedded wallet.

According to the announcement released on Wednesday, this four-month assessment is funded by the non-profit organization Brink, which supports Open Source Bitcoin protocol development, and is coordinated by the Open Source Technology Improvement Fund (OSTIF). The assessment focuses on the peer-to-peer network layer (the main attack surface of the network) as well as related components, including mempool management, chain state, transaction validation, and consensus logic.

The audit was completed in September, taking 100 working days by three Quarkslab engineers, with technical support from Brink and the Bitcoin development company Chaincode Labs. Before the code review began, the two auditors had face-to-face communication with Brink's engineers to familiarize themselves with the architecture and development practices of Bitcoin Core.

This process combines manual code analysis, dynamic testing, and advanced fuzz testing techniques borrowed from the existing continuous integration workflow of Bitcoin. Fuzz testing is an automated software testing technique that attempts to find vulnerabilities by inputting a large amount of unexpected, random, or malformed data into the code.

Brink pointed out in another article that the purpose of this move is not to certify Bitcoin Core, but to “actively search for vulnerabilities, improve testing methods, and find practical ways to strengthen the codebase.”

Quarkslab reported that no serious, high-risk, or medium-severity issues were found. The auditors did identify two low-risk issues and provided 13 informational recommendations, but these issues do not meet the security vulnerability classification standards of Bitcoin Core.

Quarkslab stated: “Although no major impact issues were found, the existing fuzz testing framework and the new framework for covering untested scenarios such as chain reorganization have both been improved.” OSTIF added: “Although this audit found no issues with significant, high-risk, or medium security impacts, it provided valuable feedback, insights, information, and testing improvement suggestions for Bitcoin.” (The Block)