CVE-2024-38365: Btcd Bitcoin Client DoS Vulnerability

CVE-2024-38365 Overview

CVE-2024-38365 affects btcd, an alternative full-node Bitcoin implementation written in Go. Versions 0.10 through 0.24 incorrectly re-implement Bitcoin Core's FindAndDelete() function. This function is consensus-critical, so any behavioral divergence can cause btcd nodes to accept invalid blocks or reject valid ones. An attacker can craft a standard Bitcoin transaction that produces a different sighash on btcd than on Bitcoin Core, triggering a chain split or a denial of service against btcd nodes. The flaw is remotely exploitable by any Bitcoin user without hash power because the malicious transaction propagates through the peer-to-peer network before inclusion in a block [CWE-670].

Critical Impact
Any unauthenticated Bitcoin user can broadcast a standard transaction that forces btcd nodes into consensus divergence with Bitcoin Core, enabling chain splits or node-level denial of service.

Affected Products

btcd versions 0.10 through 0.24.1
Downstream Bitcoin services and wallets relying on btcd for consensus validation
Lightning Network node operators using lnd paired with vulnerable btcd releases

Discovery Timeline

2024-10-11 - CVE-2024-38365 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38365

Vulnerability Analysis

The defect resides in btcd's removeOpcodeByData(script []byte, dataToRemove []byte) function inside the txscript package. This function removes any data push from script whose payload contains dataToRemove as a substring. Bitcoin Core's reference FindAndDelete() behaves differently: it only removes data pushes that exactly match dataToRemove.

The divergence changes the script bytes passed into the signature hash computation. When btcd computes a different sighash than Bitcoin Core for the same transaction, the two implementations reach opposing verdicts on signature validity. One node accepts the block while the other rejects it, splitting the chain at that height.

Because the malformed transaction is standard under P2P relay rules, it propagates freely across the mempool without requiring miner cooperation. An attacker never needs hash power to trigger the split.

Root Cause

The root cause is a control-flow implementation error [CWE-670] in txscript. Given script = "<data> <data||foo>" and dataToRemove = "data", btcd strips both data pushes while Bitcoin Core's FindAndDelete strips only the first exact <data> push. The residual script fed into signature hashing differs, producing incompatible sighashes.

Attack Vector

An attacker constructs a legacy (non-SegWit) transaction containing a signature check whose script code contains a data push that is a superstring of the signature bytes being removed. The attacker broadcasts the transaction to the Bitcoin P2P network. Miners include it in a block. btcd nodes and Bitcoin Core nodes then disagree on whether the block is valid, producing a chain split or a btcd denial of service.

// Security patch in txscript/engine.go
// Adds a new verification flag to reject the problematic construct
// ScriptVerifyDiscourageUpgradeablePubkeyType defines if unknown
// public key versions (during tapscript execution) is non-standard.
ScriptVerifyDiscourageUpgradeablePubkeyType

// ScriptVerifyConstScriptCode fails non-segwit scripts if a signature
// match is found in the script code or if OP_CODESEPARATOR is used.
ScriptVerifyConstScriptCode

Source: btcd commit 04469e6

// Security patch in txscript/error.go
// New error codes surface the rejection reasons
// ErrNonConstScriptCode is returned when a signature match is found when
// calling removeOpcodeByData in a non-segwit script.
ErrNonConstScriptCode

// ErrCodeSeparator is returned when OP_CODESEPARATOR is used in a
// non-segwit script.
ErrCodeSeparator

Source: btcd commit 04469e6

Detection Methods for CVE-2024-38365

Indicators of Compromise

btcd logs showing block validation failures where peer Bitcoin Core nodes accept the same block
Sudden divergence between local btcd best block hash and hashes reported by public block explorers
Unexpected btcd node stalls or repeated re-validation of the same block height

Detection Strategies

Compare the block hash at chain tip between local btcd nodes and reference Bitcoin Core nodes at frequent intervals
Alert on btcd process versions matching 0.10.x through 0.24.1 in software inventory scans
Monitor mempool for legacy transactions containing OP_CODESEPARATOR in non-SegWit script paths

Monitoring Recommendations

Ingest btcd node logs into a centralized logging platform and alert on script validation errors referencing removeOpcodeByData
Track outbound peer disconnections and orphaned block counts as leading indicators of a consensus split
Correlate node version telemetry with the published fixed release v0.24.2 to identify unpatched infrastructure

How to Mitigate CVE-2024-38365

Immediate Actions Required

Upgrade all btcd deployments to version v0.24.2 or later immediately
Audit dependent services such as lnd and custody platforms that rely on btcd for block validation
Cross-check current chain tip against Bitcoin Core reference nodes before resuming production traffic

Patch Information

The issue is fixed in btcd release v0.24.2. The fix introduces the ScriptVerifyConstScriptCode flag, which fails non-SegWit scripts when a signature match occurs during removeOpcodeByData or when OP_CODESEPARATOR appears. See the GitHub Security Advisory GHSA-27vh-h6mc-q6g8 and the Delving Bitcoin disclosure for full technical context.

Workarounds

No workarounds exist; the vendor advisory states upgrading to v0.24.2 is the only remediation
Operators unable to upgrade should stop relying on btcd for consensus validation and defer to a Bitcoin Core node until patched

bash

# Upgrade btcd to the patched release
git clone https://github.com/btcsuite/btcd.git
cd btcd
git checkout v0.24.2
go install -v . ./cmd/...
btcd --version