Unveiling BigSpender-Double or Multiple Spend Vulnerability in Major Bitcoin Wallets
July 3, 2020 12:49 pm
On July 2, The first keyless bitcoin and cryptocurrency wallet — the most simple and secure way to manage your crypto assets, ZenGo identified a double-spend exploit targeting several popular Bitcoin (BTC) wallets, dubbed ‘BigSpender’ of nine cryptocurrency wallets tested by ZenGo, BRD, Ledger Live, and Edge were found to have been vulnerable to a new double-spend and multiple spend attacks, but some believe the vulnerability is inherent to Bitcoin itself.
The three companies updated their products after ZenGo notified them of the threat, however, the firm warned that “millions” of crypto users may have been exposed to the exploit prior to its identification. Despite the wallets’ move to protect against BigSpender, Bitcoin Cash (BCH) proponent Hayden Otto claims the vulnerability is inherent to Bitcoin “by design” and can still be exploited.
BigSpender was discovered through ZenGo’s ongoing research into Bitcoin’s ‘Replace-by-Fee’ (RBF) feature. According to the security firm, “RBF is a standard method to allow users to “undo” a yet to be confirmed transaction, by sending another transaction spending the same coins (but possibly different destination) with a higher fee”.
BigSpender is not the first time an exploit has targeted Replace-by-fee (RBF) vulnerabilities to execute a double-spend attack, with a similar technique being notoriously outlined in a video published by Hayden Otto in December that quickly went viral. The exploit is only possible with zero confirmations.
Otto said that RBF attack’s are “particularly concerning for BTC-accepting merchants who could have easily handed over goods to a customer who then reversed their BTC transaction upon leaving the store.”
“The technique is facilitated by RBF (replace by fee), a so-called ‘feature’ added at the protocol level by the Bitcoin Core developers. The issue exists if you use BTC. Wallet software can only make some trade-off, which results in a worse BTC user experience, in order to try to protect BTC users.”
The BCH proponent described the exploit as “an issue with BTC itself,” adding that it has “nothing to do with the various wallet software”.
Wallets challenge the severity of the threat
Though not everyone is convinced that BigSpender comprises a grave threat to Bitcoin, with the affected wallet providers challenging the language employed by ZenGo’s researchers.
Speaking to Forbes: Ledger asserted: “There is no actual double-spend being performed. The user funds stay safe. Nevertheless, the display of received transactions could be misleading.”
This is of course, what Otto exploited: getting merchants to hand over the goods before the funds were transferred due to a “misleading” display. Despite, merchants who wait for transactions to be confirmed before sending goods do not risk being affected.
ZenGo has released a free open-source tool that allows wallet providers to test their products and secure against the BigSpender vulnerability. The firm noted that not all of the wallets affected by the exploit have implemented upgrades.