Bitcoin Core 32 enters final testing with faster validation, fee changes and security fixes
The October update changes how nodes estimate transaction fees and process blocks, while fixing a wallet flaw that could let an authenticated user run commands on a node.
By Shaurya Malwa|Edited by Jamie Crawley
3 min readMake preferred on ShareShare this article
Copy linkX iconX (Twitter)LinkedInFacebookEmail
- Bitcoin Core 32.0 entered final testing on Sept. 14, with its finished release scheduled for Oct. 10. - The update aims to improve fee estimates, accelerate block processing and make PSBT version 2 the default for several wallet commands without changing Bitcoin’s consensus rules. - Developers fixed a command-execution vulnerability affecting certain wallet configurations and a memory-exhaustion flaw in the new web server before the software’s stable release.
Bitcoin Core, the software used to run Bitcoin nodes, has moved its next major update into final testing with changes to transaction fees, block processing and the way wallets build transactions.
The first release candidate for Bitcoin Core 32.0 was tagged on Sept. 14, starting the final testing cycle before developers aim to release the finished version on Oct. 10, according to the project's release schedule.
Bitcoin Core lets a computer independently check transactions and blocks against Bitcoin's rules rather than relying on another service. Version 32 does not change those rules.
Bitcoin Core currently estimates how much a user should pay for a transaction largely by looking at the fees attached to transactions that made it into previous blocks. Version 32 adds a second estimator that looks at transactions currently waiting to be confirmed.
The software will compare the two and can recommend the lower fee when current network conditions support it. That should let estimates fall more quickly when congestion clears instead of continuing to reflect more expensive transactions from earlier blocks, according to the draft release notes.
Nodes can now fetch transaction data from their databases using several processing threads at once while checking blocks. Bitcoin Core will use eight of those threads by default, reducing time spent waiting for information stored on disk when a node is catching up with the blockchain.
Developers also fixed a flaw that had existed since Bitcoin Core 24.0 on non-Windows systems.
An authenticated user with permission to create wallets could give one a specially crafted name and, under certain conditions, cause commands to run on the computer hosting the node. The attack required the operator to have enabled walletnotify, a feature that automatically runs a chosen command when a wallet transaction occurs. Bitcoin Core 32 treats wallet names as literal text instead of allowing parts of the name to be interpreted as commands.
Wallet changes and a memory flaw
Four Bitcoin Core commands used to create partially signed transactions will also start using the newer PSBT version 2 format by default. Those transactions are commonly passed between wallet software and signing devices before bitcoin is sent.
Applications can still request the older format, but services built directly around those Core commands will need to make sure they support version 2.
Version 32 also replaces Bitcoin Core's existing web server, which handles requests from other applications communicating with a node.
An audit of the new server, carried out using Moonshot AI's Kimi K3 model, found that it could keep accepting data from a client while still processing an earlier request. That data accumulated in memory faster than the server could clear it, creating a way to keep increasing a node's memory use until it ran out.
The developer who submitted the fix described it as a memory-exhaustion scenario. The new server has not appeared in a stable Bitcoin Core release, meaning the problem was caught before version 32 shipped.
Testing also showed that the problem extended to Bitcoin Core's REST interface, which can be used without login credentials.
Sixteen unauthenticated REST connections took one test node from 46 MB of memory to about 3 GB in roughly a minute. A 90-second test used 3.2 GB of memory before the fix and about 3 MB after it.
- 1Bitcoin loses touch with the Dollar Index, U.S. stocks ahead of the Fed47 min ago
- 2Bitcoin traders brace for Fed hike, but a surprise hold could pose bigger risk1 hr ago
- 3Two Prime makes onchain finance push with $10 million-backed bitcoin yield vault1 hr ago
- 4Bitcoin ETFs shed $450 million as Clarity Act fails1 hr ago
- 5Deutsche Bank close to debuting crypto custody for institutions1 hr ago
- 6Live updates: Bitcoin holds near $76,000 as spot ETFs outflows surged alongside Clarity Act failure1 hr ago
- 7Circle debuts Arc blockchain which Jeremy Allaire calls ‘more consequential’ than USDC1 hr ago
- 8Bitcoin's Coinbase premium sinks to one-month low, here’s why2 hrs ago
- 9Two Robinhood engineers charged with insider trading using Hyperliquid perpetuals2 hrs ago
- 10Ethereum, Base give up on common wallet standard after months of talks3 hrs ago
The Definitive Stablecoin Landscape Series: Asia Pacific
The Definitive Stablecoin Landscape Series: Asia Pacific
As stablecoins move into regulated finance, APAC is becoming a key proving ground. This report maps the region’s rules, use cases, and RLUSD’s role.
By CoinDesk Research
Commissioned byRipple
As stablecoins move into regulated finance, APAC is becoming a key proving ground. This report maps the region’s rules, use cases, and RLUSD’s role.
As stablecoins move into regulated finance, APAC is becoming a key proving ground. This report maps the region’s rules, use cases, and RLUSD’s role.
Ethereum, Base give up on common wallet standard after months of talks
Zcash holders overwhelmingly back faster transactions and bitcoin-style halvings
A hacker turned 25 cents of bitcoin into 46 billion fake BTC tokens on a DeFi bridge
