Quarkslab Completes First Public Third‑Party Security Audit Of Bitcoin Core
In Brief
Quarkslab completed Bitcoin Core’s first public third‑party security audit, finding no major vulnerabilities and only minor issues.
Cybersecurity firm Quarkslab announced that it has completed the first public third-party security audit of Bitcoin Core. The assessment was funded by Brink and coordinated by the Open Source Technology Improvement Fund (OSTIF). Quarkslab has collaborated with OSTIF since 2015 and has conducted blockchain-related security audits since 2018, beginning with a review of Monero’s Bulletproofs implementation.
In this engagement, Quarkslab conducted a detailed security evaluation of Bitcoin Core to support developers and the community in enhancing the ecosystem’s security. The audit combined static analysis with dynamic testing to provide a comprehensive view of the system’s security posture, assess existing testing methods, and propose new approaches.
Bitcoin Core is the reference implementation of the Bitcoin network, supporting a multi-trillion-dollar asset and including a full-node client, GUI, mining features, and an embedded wallet. Since its initial release by Satoshi Nakamoto in August 2009, it has undergone extensive development, accumulating over 46,000 commits in 16 years. Written in C and C++, it is maintained by dozens of active contributors, many funded by organizations such as Brink and Chaincode Labs, and forms the foundation of Bitcoin’s decentralized infrastructure. While the protocol itself is rarely updated, the codebase is continuously refined and modularized. With the vast number of nodes running this software, any flaw could have systemic implications, making a comprehensive third-party audit an important addition to ongoing security efforts by Bitcoin Core developers.
The audit was conducted over a period from May to September, totaling 100 man-days. Due to the size of the codebase, the assessment focused on the peer-to-peer networking layer, the main attack surface of the Bitcoin network. This included the mempool, peer and chain management, and consensus and policy-validation logic.
The work was structured into three stages: a manual code review targeting thread management and transaction validation, dynamic testing using existing Bitcoin tooling and frameworks, and advanced fuzz testing with methods not previously or rarely applied to the codebase. The audit aimed to identify potential vulnerabilities and support the community in strengthening overall security through direct contributions, such as pull requests and new fuzzing harnesses, and by exploring new approaches to harden the codebase and testing processes.
Quarkslab Audit: No High‑Impact Issues In Bitcoin Core, Testing Enhancements And Fuzzing Improvements Recommended
Researchers identified two low-severity findings and thirteen informational recommendations during the audit, none of which pose any security risk according to Bitcoin Core’s vulnerability classifications. A large portion of the work focused on strengthening Bitcoin Core’s testing framework, utilizing internal fuzzing tools and specialized expertise. This included creating new fuzzing harnesses for block connections and chain reorganizations, which exercised previously untested code paths and addressed recommendations to enhance thread-safety annotations and overall code readability.
The engagement also led to several improvements in Bitcoin Core’s testing infrastructure, including an expanded test corpus to increase coverage, a Docker image to facilitate ensemble fuzzing campaigns, an experimental non-regression testing tool based on Bitcoin tracepoints, and the exploration of various fuzzing methods such as structured and differential fuzzing.
The assessment concentrated on the peer-to-peer components and the most impactful attack scenarios affecting consensus or protocol availability. No high-impact issues were detected, though incremental enhancements were made to existing fuzzing harnesses and new ones were introduced to cover untested scenarios like chain reorganizations. Alternative testing approaches, including ensemble and differential fuzzing, were explored and are expected to add value to the overall testing strategy and project resilience. In particular, Fuzzamoto 2, the snapshot fuzzing method being developed by Brink, is considered a promising avenue for uncovering more complex bugs.
Quarkslab expressed gratitude to engineers from Brink and Chaincode Labs for their ongoing support throughout the audit. The evaluation highlighted Bitcoin Core’s strong architecture, reliability, and maturity. Quarkslab emphasized that the experience of reviewing such sophisticated and well-designed software was highly valuable and hopes that their findings will further strengthen the project.
Disclaimer
In line with the Trust Project guidelines, please note that the information provided on this page is not intended to be and should not be interpreted as legal, tax, investment, financial, or any other form of advice. It is important to only invest what you can afford to lose and to seek independent financial advice if you have any doubts. For further information, we suggest referring to the terms and conditions as well as the help and support pages provided by the issuer or advertiser. MetaversePost is committed to accurate, unbiased reporting, but market conditions are subject to change without notice.
About The Author
Alisa, a dedicated journalist at the MPost, specializes in cryptocurrency, zero-knowledge proofs, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance.
More articles
Alisa, a dedicated journalist at the MPost, specializes in cryptocurrency, zero-knowledge proofs, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance.
