# CVE-2024-38365 public disclosure (btcd \`FindAndDelete\` bug) **URL:** \ **Category:** Implementation\ **Tags:** announcement\ **Created:** [October 10, 2024, 9:02am UTC](https://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug/1184 "2024-10-10T09:02:17Z")\ **Posts on this page:** 1\ **Showing post:** 1
**Author:** ![AntoineP](https://delvingbitcoin.org/user_avatar/delvingbitcoin.org/antoinep/32/483_2.png) [@AntoineP](https://delvingbitcoin.org/u/AntoineP)\ **Post date:** [October 10, 2024, 9:02am UTC](https://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug/1184/1 "2024-10-10T09:02:17Z")
This work is a collaboration between Niklas Gögge ([Brink](https://brink.dev/)) and Antoine Poinsot ([Wizardsardine](https://wizardsardine.com/)). Btcd prior to version [0.24.2](https://github.com/btcsuite/btcd/releases/tag/v0.24.2) does not correctly implement the consensus rules for legacy signature verification. The incompatible behavior can be triggered by a standard transaction, making it possible for anyone to fork off vulnerable btcd nodes at virtually no cost. # Details When verifying a signature for a transaction input, the script interpreter of a Bitcoin node re-constructs the signed message and checks the signature against it. The original algorithm for re-constructing the message is detailed in [this wiki page](https://en.bitcoin.it/wiki/OP_CHECKSIG#How_it_works). Notably, the signed message contains a commitment to the Script being executed. For legacy transaction inputs any occurrence of the signature being verified is first removed from the executed Script committed in the message. This is often referred to as the `FindAndDelete` behavior, named after the function implementing this in Satoshi Nakamoto’s original Bitcoin codebase. `removeOpcodeByData` is Btcd’s equivalent of Bitcoin Core’s `FindAndDelete`. Prior to version 0.24.2, `removeOpcodeByData` would remove any data push from the executed Script that _contains_ the signature. Whereas Bitcoin Core’s (and Satoshi’s) `FindAndDelete` only removes exact matches. Using public key recovery it is possible to create a Script which contains a signature check and an extraneous data push which contains the signature itself and additional padding data. This Script can be committed to in a P2SH output which can be spent by a standard transaction which would be considered valid by Bitcoin Core and invalid by vulnerable Btcd nodes. This bug was introduced in commit [`76339baf6c9407b073828245e3458f4df35190ae`](https://github.com/btcsuite/btcd/commit/76339baf6c9407b073828245e3458f4df35190ae) in 2014, in reaction to a new Bitcoin Core unit test demonstrating the original implementation was consensus-incompatible. # Credits Thanks to the Btcd maintainers for awarding us a bug bounty. # Timeline - 2024-03-20 Niklas and Antoine discuss the quirks of Bitcoin Core’s `FindAndDelete` (in relation to Antoine’s research into the [worst case block validation time](https://delvingbitcoin.org/t/great-consensus-cleanup-revival/710)) and decide to take a look at if Btcd got all the quirks right in their reimplementation - 2024-03-22 Niklas and Antoine email a detailed report of the issue to Olaoluwa Osuntokun - 2024-03-26 Olaoluwa acknowledges the issue and creates a discussion group with another Btcd maintainer - 2024-05-07 Antoine reserves [CVE-2024-36051](https://www.cve.org/CVERecord?id=CVE-2024-36051) through Mitre - 2024-06-21 Laolu reserves [CVE-2024-38365](https://github.com/btcsuite/btcd/security/advisories/GHSA-27vh-h6mc-q6g8) through Github - 2024-04-26 A covert fix is included in PR [#2178](https://github.com/btcsuite/btcd/pull/2178) - 2024-05-22 PR [#2178](https://github.com/btcsuite/btcd/pull/2178) is merged - 2024-06-25 Version 0.24.2 is released with the fix - 2024-09-20 Public disclosure --- _[View the full topic](https://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug/1184)._