Raising the fee on a slow bitcoin payment is meant to rescue it. In at least one case involving the Electrum wallet, it handed the money to an attacker.
Electrum’s developers published a security advisory on Oct. 24. The developers label the flaw high severity and report it being exploited in the wild. Every Electrum release before version 4.8.3 is affected. The fix is in version 4.8.3, whose binaries came out Oct. 24.
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
Inside the Trick
Because Electrum leans on a server for the state of unconfirmed transactions, a dishonest server has room to lie. That trade-off is part of the wallet’s documented design.
What the user sees depends on the server. It withholds the real payment from the network and reports a rival version in which the destination has been swapped for the attacker’s. The wallet had no check on that version’s invalid signatures, so it showed the rival as the transaction in progress.
One of the forgeries paid no fee, which the advisory says was “presumably in hope of the user bumping its fee.” The user obliged, and Electrum signed a valid replacement that paid the attacker.
The developers received two reports. Both victims reported that the thief’s address ended with the same four characters as the one they meant to pay. One of the users, credited as Raju-K12, “bumped the fee of tx2 and lost money,” the advisory said, referring to the fake transaction. Neither the advisory nor the release notes disclosed how much was taken or which servers were involved.
The Fix
Version 4.8.3 adds one check. Signatures on mempool transactions that spend the wallet’s own coins are verified before those transactions go into the local history. The advisory lists incoming transactions as an example of what is still not validated.
A private disclosure arrived Oct. 11, but the advisory notes that “the bump_fee vector is not realised” at that point. The fee-bump theft became clear a week later, when Raju-K12 reported losing money on Oct. 18.
“Clients that connect to servers they trust (e.g. run their own) are not affected,” the advisory said. Short of upgrading, the advisory says to read the outputs on screen every time, bump or no bump. Connecting only to servers you trust also avoids the problem.
Related Listen: Why the Theft of $100 Million From Ledgers Took ‘Months of Research and Development’
The post Malicious Electrum Servers Steal Bitcoin by Baiting Users Into Fee Bumps appeared first on Unchained.