Announcements

Please join us for our next Socratic Seminar. A special thank you to our sponsors Chaincode Labs and Cake Wallet for food, refreshments and event space.

This month’s event will be held on a Wednesday! We will open doors at 6pm for socializing, and plan on starting the discussion around 7pm.

If you can’t make it to the main event please join us at PUBKEY around 9:30PM.

Follow New York BitDevs on:

• Twitter
• BlueSky
• nostr: npub1nydevscv0slx9eyr0chkkdgzqfhtp4guk039akhq6g9fnsrf6lcsup3hqs

Presentation

• Constantine Doumanidis will talk about “Routing Attacks on Decentralized Consensus”

Mailing Lists, Meetings and Bitcoin Optech

Mailing Lists

bitcoin-dev

• (BIP Proposal) Standard Encrypted Wallet Payload + Standard Encryption Envelope formats
• Bitcoin Core 30.0 release candidate is available
• IRC logs: BIP 348 Workshop
• BIP Booby Trapped Wallets - Covenant-Only Taproot Outputs
• (BIP Proposal) Add BIP-0093 (Codex32) as application to BIP-0085
• (BIP Proposal) OP_TWEAKADD
• Bitcoin Knots 29.1.knots20250903 released
• Workshops and Activation for CHECKTEMPLATEVERIFY and CHECKSIGFROMSTACK
• IRC logs: BIP 119 Workshop
• (BIP Draft) Bitcoin Encrypted Backup
• FROST CLI + BDK CLI Demo
• (BIP Proposal) Elliptic Curve Operations for Bitcoin Script
• Bitcoin Core 29.1 release candidate 2 available
• (Draft BIP) Quantum-Resistant Transition Framework for Bitcoin
• Glock: Garbled Locks for Bitcoin
• (BIP Proposal) Block template sharing

Delving Bitcoin

• Measuring minrelaytxfee across the Bitcoin network
• Peer-observer: A tool and infrastructure for monitoring the Bitcoin P2P network for attacks and anomalies
• MultiChannel and MultiPTLC: Towards A Global High-Availability Consistent/Partition-Tolerant Database For Bitcoin Payments
• Bitcoin Core v30.0 release candidate is available
• Bitcoin Core v29.1 Released
• Provable Cryptography for Bitcoin: An Introduction (Workbook)
• Eclipsing Bitcoin Nodes with BGP Interception Attacks
• Delving Simplicity Part Ⅲ: Building Data Types
• The state of bitcoinfuzz
• Taking a second look at OP_EXPIRE
• Delving Simplicity Part Ⅱ: Combinator Completeness of Simplicity
• Selfish mining fix with a simulation

Meetings

• Bitcoin Core general developer meetings
  • August 21
  • August 28
  • September 4
  • September 11
• Lightning Specification meeting
  • August 25
  • September 8
  • September 22

Optech

• Bitcoin Optech Newsletter #371 - Recap Podcast
• Bitcoin Optech Newsletter #370 - Recap Podcast
• Bitcoin Optech Newsletter #369 - Recap Podcast
• Bitcoin Optech Newsletter #368 - Recap Podcast

Network Data

• Alby Hub channel statistics
• Canadian police seize funds, announce via OP_RETURN
• Fresh rpi IBD data
• Large number of lightning force-closes hit chain
• Misbehaving Nodes
• Ordinals – Impact On Node Runners
• stratum.work adds new “Events” panel
• testnet4 timewarp attack, counterattack by garrys mod

CVEs and Research

Research

• AUPCH: Auditable Unlinkable Payment Channel Hubs
• Boosting Payment Channel Network Liquidity with Topology Optimization and Transaction Selection
• Bitcoin as an Interplanetary Monetary Standard with Proof-of-Transit Timestamping
• Bitcoin under Volatile Block Rewards: How Mempool Statistics Can Influence Bitcoin Mining
• BitPriv: A Privacy-Preserving Protocol for DeFi Applications on Bitcoin
• ChipmunkRing: A Practical Post-Quantum Ring Signature Scheme for Blockchain Applications
• Hornet Node and the Hornet DSL: A Minimal, Executable Specification for Bitcoin Consensus
• How Exclusive are Ethereum Transactions? Evidence from non-winning blocks
• Infiltrated Selfish Mining: Think Win-Win to Escape Dilemmas
• Outperforming Dijkstra on Sparse Graphs: The Lightning Network Use Case
• Payment Channels with Proofs
• Threshold ECDSA in Two Rounds
• Trout: Two-Round Threshold ECDSA from Class Groups

InfoSec

• A Vulnerability on Bitcoin Protocols Using One-Time Signatures
• A16-FuseBypass: Debug Logic Enabled on Production Apple Silicon
• Block filter design guide
• Cloudfare mitigates largest DDoS attack ever, 11.5 Tbps, more
• Geedge & MESA Leak: Analyzing the Great Firewall’s Largest Documented Leak
• iOS remote code execution vulnerability discovered
• Monero experiences multiple block reorgs, more
• Not in The Prophecies: Practical Attacks on Nostr
• npm packages with 2 billion weekly downloads in supply chain attack
• Phoenix: Rowhammer Attacks on DDR5 with Self-Correcting Synchronization
• Samsung Issues Emergency Update For Most Galaxy Users
• Self-propagating supply chain attack hits 187 npm packages
• signet: disk-space-DoS due to low mining difficulty
• Use mutation testing to find the bugs your tests don’t catch

Pull Requests and repo updates

Bitcoin Core

• cmake: Install bitcoin manpage
• net: do not apply whitelist permissions to onion inbounds
• test: Add submitblock test in interface_ipc
• wallet: Identify transactions spending 0-value outputs, and add tests for anchor outputs in a wallet
• net: Prevent node from binding to the same CService
• Release: 30.0 translations update
• guix: strip binaries in libexec
• net: check for empty header before calling FillBlock
• index: Fix coinstats overflow
• rpc: followups for min fee changes
• index: Don’t commit state in BaseIndex::Rewind
• ipc: Handle unclean shutdowns better
• contrib: add bitcoin binary to gen-manpages
• Fix benchmark CSV output
• net: Add interrupt to pcp retry loop
• contrib: update fixed seeds
• Update libmultiprocess subtree to improve build and logs
• Add functional test for IPC interface
• net: Quiet down logging when router doesn’t support natpmp/pcp
• net, pcp: handle multi-part responses and filter for default route while querying default gateway
• doc: truc packages allow sub min feerate transactions
• ci: Migrate CI to hosted Cirrus Runners
• kernel: chainparams & headersync updates for 30.0
• doc: unify datacarriersize warning with release notes
• Revert compact block cache inefficiencies
• threading: reduce the scope of lock in getblocktemplate
• Update libmultiprocess subtree to fix build issues
• miner: clamp options instead of asserting
• wallet: Remove isminetypes
• Add bitcoin-{node,gui} to release binaries for IPC
• kernel: improve BlockChecked ownership semantics
• test: use local CBlockIndex in block read hash mismatch check
• index: fix wrong assert of current_tip == m_best_block_index
• wallet, rpc: add v3 transaction creation and wallet support

BDK

• Add last_evicted field to TxNode
• FilterIter API redesign
• fix(electrum): fix stale anchor hash on reorg
• Add populate_anchor_cache method to bdk

HWI

• Fix CI

rust-bitcoin

• Standard I/O ops for encoders
• Remove hashes from the public API of Txid
• simplify is_op_return() using map_or instead of match
• perf: optimize Vec creation in bip152 tests
• Manually implement serde traits for OutPoint
• Add bench for sha3_256
• bip158: Return no match for empty query
• Introduce and enforce import statement policy
• Add a sha3_256 module with SHA3-256
• Scriptbuf push int
• Introduce pull encoding and use it for blockhash computation
• primitives: Use new import policy
• bitcoin: add “extreme object size” deserialization unit test
• Add a bunch of project management docs
• Manually print InvalidChecksum
• Add dependency policy doc
• Fix SerializedSignature iteration stack overflow
• Introduce script tagging
• io: Enable features in internals crate
• base58: Remove hex dependency
• Introduce Ntxid
• bitcoin: remove From<Message> for TapSighash
• Move policy stuff to docs directory

libsecp

• test: introduce group order byte-array constant for deduplication
• musig: Invalidate secnonce in secp256k1_musig_partial_sign
• schnorrsig: Securely clear buf containing k or its negation
• hash: Use size_t instead of int for RFC6979 outlen copy
• tests: refactor tagged hash verification

secp256k1-zkp

• extrakeys: fix pubkey_sort_cmp test

Core Lightning

• fuzz-tests: fix overflow in fuzz-close_tx
• fuzz-tests: improve fuzz-channel_id
• fuzz-tests: improve fuzz-bolt11
• fuzz-tests: add a test for handle_peer_error_or_warning()
• fuzz-tests: improve fuzz-bigsize
• common/amount: prevent scaling with invalid factors in amount scale functions
• fuzz-tests: verify round‑trip scriptpubkey-to-addr conversion
• fuzz-tests: Add fuzz target for closing_sig
• fuzz-tests: Add fuzz target for closing_complete
• tests: Fix numerous resource leaks
• common/bolt11: Fix BOLT11 hash calculation for unknown fallback address versions
• plugins/bcli: use -rpcwait to simplify waiting for bitcoind to warm up
• common: fix dangling memory allocation in daemon_conn_new_()
• connectd: fix diagnostics if we get a long delay.
• Release: fix build inside Fedora
• bkpr: don’t leak event in fillin_apy_acct_details.
• Fix accounting migration2
• htlc_wire: fix crash when adding an HTLC
• pay: fix uninitialized var in debug output.
• offers: loosen payment_constraints on invoices’ blinded paths.
• plugins: generate certificates with required extensions
• Bookkeeper migration
• minchannel opening fix
• xpay BIP353 support
• Add macOS uv instructions to installations.md
• fetchinvoice fix for disconnected peers
• Reckless: dont crash the plugin
• avoid UB when calling ctype functions
• Actually check, cleanup, notification schemas

eclair

• Correctly fill PSBT for taproot interactive-tx
• Increase timeout for flaky onion message tests
• Resign next remote commit on reconnection
• Update taproot commit weight to match lnd
• Remove legacy channel codecs
• Update Bitcoin Core to v29.1
• Eclair v0.13.0 release
• Fix flaky OfferPaymentSpec
• Add high-S signature Bolt 11 test vector
• Relax taproot feature dependency
• Fix comparison of utxos in the balance
• Catch close commands in Offline(WaitForDualFundingSigned)
• Re-encode channel data using v5 codecs
• Use balance estimates from past payments in path-finding
• Allow non-initiator RBF for dual funding
• Allow overriding max-closing-feerate with forceclose API
• Add GossipTimestampFilter buffer during gossip queries to fix flaky tests
• Adjust batch_size on commit_sig retransmission
• Split commit nonces from funding nonce in tx_complete
• Allow omitting previousTx for taproot splices
• Simple taproot channels
• Extract CommitParams to individual commitments
• Offers with currency must set amount.
• Use CLTV expiry when computing reputation
• Add recent invoice spec test vectors

LDK

• Splice channel state rework
• Always-online node forward invoice request
• Account for splices in claimable balances
• Async send always-online counterparty side
• Create a single P2A anchor on commitment transactions in 0FC channels
• Update channel_reestablish for splicing
• Drop the need for fork headers when calling Listen’s disconnect
• Serialization for Vec BlindedMessagePath
• Async send prefactor
• Add a method to avoid re-persisting monitors during startup
• Randomize order of inputs from OutputSweeper
• Validate funding contributions reserves in splice_init and splice_ack handling
• Add LSPS5 DOS protections.
• Async FilesystemStore
• Commit to client’s node id in bLIP-52/LSPS2 promise
• Allow changing ChannelManager::default_configuration at runtime
• Make connect_with_unknown_server actually connect to unknown server
• Improve privacy for Blinded Message Paths using Dummy Hops
• Integrate Splicing with Quiescence
• Clean up and split up is_pre_funded_state
• Emit DiscardFunding events for double spent splice transactions
• Support splice shared input signing
• Replay lost MonitorEvents in some cases for closed channels
• Add splice-out support
• Remove invoice_id from static invoice server protocol
• Fix panic when calling batch_funding_transaction_generated early
• Simplify Quiescence and prepare for splice integration
• Allow building Invoice from Bolt11InvoiceDescriptionRef
• Peer Storage (Part 3): Identifying Lost Channel States
• Fix initial commitment_signed for splicing
• lightning-liquidity: Pre-/Refactors to prepare for persistence
• offer: fix path validation to only require non-empty paths when issuer_id is missing
• Detect commitment transaction confirmation in ChannelMonitor instead

lnd

• Add Support for P2TR Fallback Addresses in BOLT-11
• Expose confirmation count for pending ‘channel open’ transactions
• multi: use relaxed feature bit Set method for peer features
• multi: attempt to more uniformly use SpewLogClosure across project
• build: make special label checks auto-pass instead of skip
• multi: switch on graph SQL migration
• graph/db: unwrap dns addresses from opaque ones during migration
• multi: Rename LightningNode to Node
• (1/2) discovery+lnwire: add support for DNS host name in NodeAnnouncement msg
• Rate limit outgoing gossip bandwidth by peer
• lnwallet: use btcwallet’s new interface
• graph/db+sqldb: Make the SQL migration retry-safe/idempotent
• Catch bad gossip peer and fix UpdatesInHorizon
• move pgp check to daily builds
• lnd: use persisted node announcement settings across restarts

BIPs

• BIPs 157, 158: update status to Final, add Requires header
• BIP111: update status from Proposed to Final
• BIP352: Add intermediate vector material for silent payments
• BIP388: fix variable name in from_descriptor() to prevent NameError
• bip54: fix off-by-one in creation date
• BIP328: fix assignment in bytes_to_point function
• BIP155: update status from Draft to Final
• BIP85: replace Base64 by Base85 in PWD BASE85 section

BOLTs

• Add a SECURITY.md
• Increase channel close delay to 72 blocks
• bolt 11: add test vector for p2tr fallback address
• Update “invalid currency UTF-8” test vector

New Releases

• Frigate: experimental Electrum Server testing Silent Payments scanning with ephemeral client keys
• Stratum V2 UniFFI: Language Bindings for SRI
• The Bitcoin Dev Project releases version 2 of TLDR, daily AI generated summaries of the mailing list and Delving Bitcoin

Miscellaneous

• Aiming for ₿OSS Level 100
• Ark Labs Live
• Bitcoin Core Code: C++, some Python and a Custom Build System
• Bitcoin Core devs call dissidents ‘Knotzis,’ find bug in their software
• Bitcoin Visibility at Scale: New Upgrades to the Blockstream Explorer API
• BRC2.0 Specification Sheet
• Comer and Mace Investigate Efforts to Manipulate Information on Wikipedia
• Cryptography Camp Workbook
• Diving deeper into Lightning liquidity: Amboss Magma
• Localhost Research Transparency Report 002
• Lexe Uses LDK to Run Self-Custodial Lightning in Secure Enclaves
• My review of the proposed C header for the Bitcoin Core Kernel API
• OpenTimestamps and Knots/OCEAN
• Nerd of the Month #5: A Castle of Glass
• Nunchuck launches support of generalized miniscript
• Spiral Grants - thesimplekid, spacebear21,
• The state of Bitcoinfuzz
• The White House Is Going to Put Government Statistics on the Blockchain
• Vinteum: Three Years Year sof Building Bitcoin From the Ground Up
• Trump Family Rakes in $5B With New Crypto Cash Grab
• Why Bitcoiners should support covenant soft forks
• Unstoppable JPGs In Private Keys
• Bitcoin as an Interplanetary Monetary Standard with Proof-of-Transit Timestamping
• Practical Attacks on Nostr
• The Vulnerability Exposing Tangem Cards to Brute-Force Attacks
• Bitcoin Knots Node Ban Script
• Anatomy of a Billion-Download NPM Supply-Chain Attack
• Memecoiners erect a 12-foot golden Trump Bitcoin statue near US Capitol
• Shilld: Visible PAID SHILL badges on X/Twitter
• Cake Wallet Releases Pay Anything: Making Crypto Work the Way You Think It Should