Wiki / Events / CVE-2018-17144 (duplicate-input inflation bug)

CVE-2018-17144 (duplicate-input inflation bug)

From the Bitcoin Takeover Wiki · ✓ 3 sources · 0 podcast anchors · built 2026-11-13

A 2018 Bitcoin Core bug that could crash nodes and, in 0.15.x–0.16.2, let a miner inflate supply by spending one input twice in a block; patched in 0.16.3 before any known exploit.

◆ Takeover vieweditorial · opinion, labelled

The wiki's angle: the closest Bitcoin came to an accidental inflation fork after 2010 was found by someone outside Core and reported to Bitcoin Cash developers too, a reminder that the forked projects still shared one codebase's bugs.[2][1]

Contents

  1. Disclosure
  2. Cause
  3. Outcome
  4. References

Disclosure

The Bitcoin Core disclosure says the issue, fixed in Bitcoin Core 0.16.3 and 0.17.0rc4, “includes both a Denial of Service component and a critical inflation vulnerability”[1]. Its timeline says that on 17 September 2018 at 14:57 UTC an “anonymous reporter reports crash bug” to Pieter Wuille, Greg Maxwell and Wladimir van der Laan of Bitcoin Core, deadalnix of Bitcoin ABC and sickpig of Bitcoin Unlimited[1]. At 17:47 UTC Matt Corallo identified the inflation bug[1]. Bitcoin Takeover's forks overview says the bug was disclosed “by a Bitcoin Cash developer”, while the Core notice calls the reporter anonymous[2].

Cause

The notice says that in Bitcoin Core 0.14 an optimisation (PR #9049) skipped a costly check that multiple inputs within a single transaction did not spend the same input twice, leaving only an assertion; later changes meant that in 0.15.x to 0.16.2 the case could be exploited for inflation rather than a crash[1]. The Bitcoin Wiki lists the bug as “Missing check for duplicate inputs”[3].

Outcome

The notice says “We are unaware of any attempts to exploit this vulnerability”[1]. The Takeover overview notes that no block ever exploited it, so no split occurred, but that the affected versions had loosened a rule unnoticed[2].

References

  1. primaryBitcoin Core, “Disclosure of CVE-2018-17144” (20 Sep 2018) [archived]
  2. btkBitcoin: All the Hard Forks and Soft Forks (BTCTKVR: Forks!) [archived]
  3. secondaryBitcoin Wiki (en.bitcoin.it), “Common Vulnerabilities and Exposures” [archived]

Related

Value overflow incident (2010)
The August 2010 bug that let a transaction create about 184 billion bitcoin; Satoshi shipped 0.3.10 within hou
March 2013 chain fork
The accidental split of 11–12 March 2013, when Bitcoin 0.8 accepted a large block that older nodes could not p
Bitcoin ABC
Amaury Séchet's “Adjustable Blocksize Cap” client, which launched Bitcoin Cash in August 2017 and became eCash
Bitcoin Unlimited
A full-node client that let users and miners choose their own block size limit, governed by a voting federatio
Wladimir (Mara) van der Laan
Bitcoin Core's lead maintainer from 2014 under the name Wladimir van der Laan, chosen by Gavin Andresen; began
Categories: Events
Ask about this article: >_ terminal · Onion mirror: http://btctkvroa6xsq25wmpvvlpkcgss7724zk6fm765fvtuunfgxw74j2pyd.onion/wiki/cve-2018-17144/
>_ ask the wiki