Improper Replacement Policy in Bitcoin Core Affects Transaction Processing

CVE-2021-31876

What is CVE-2021-31876?

The identified vulnerability in Bitcoin Core versions 0.12.0 to 0.21.1 arises from a failure to properly implement the replacement policy outlined in BIP125. This oversight can potentially allow attackers to exploit unconfirmed child transactions, leading to a loss of funds or causing disruption throughout the network, particularly affecting downstream services like Lightning Network nodes. Specifically, a child transaction with the maximum sequence number (0xff_ff_ff_ff) may fail to replace a parent transaction due to inadequate enforcement in the mempool's PreChecks. This creates a window of opportunity for attackers to manipulate transaction processing and create vulnerabilities in the network.

References