safety – Was the bug bounty ever claimed for OP_CTV?

So far as I do know it was by no means claimed. Nevertheless, a bug was discovered within the implementation of OP_CTV in September 2022. This was 5 months after the shopper making an attempt to activate OP_CTV was slated for launch (April 2022). From the “7 Theses on a subsequent step for BIP-119” weblog submit dated April seventeenth 2022:

This submit begins with a conclusion:

Inside every week from as we speak, you’ll discover software program builds for a CTV Bitcoin Consumer for all platforms linked right here:

Mac OSX TODO:
Home windows TODO:
Linux TODO:
These can be constructed utilizing GUIX, that are reproducible for verification. The meant code to be constructed can be https://github.com/JeremyRubin/bitcoin/tree/checktemplateverify-v23.0rc5-paramsv0 which relies on Bitcoin Core v23.0 launch candidate 5, with commit hash dd9a4e0ea8a109d1607ca1ec16119b1bc952d8b0. You possibly can start testing this instantly, and even producing your individual GUIX builds as nicely.

Signatures for the builds can be obtainable beneath:

TODO: … .asc
The supply tarball:

TODO: … .tar.gz
The shopper has a Speedy Trial launch just like Taproots with parameters proposed to be:

Sign Begin MTP: 1651708800 (Could fifth, 2022, 00:00 UTC)
Sign Timeout MTP: 1660262400 (August twelfth, 2022, 00:00 UTC)
Activation Top: 762048 (Roughly Nov ninth)
See the appendix to confirm these parameters.

This ensures 6 signalling durations to activate CTV. The Begin and Timeout are concentrating on mid-period (if hashrate stays regular) instances to make sure that it’s unlikely we’d have extra or fewer durations.

The week delay between this submit and builds is to supply time for evaluate on the number of parameters in addition to capacity to rebase onto a ultimate v23.0 launch, ought to it develop into prepared inside the week. Backports are within the works for v22.0, however launch builds might not be made obtainable as Bitcoin’s launch construct processes have modified since v22.0 to make use of GUIX. The department for backports is accessible right here: https://github.com/JeremyRubin/bitcoin/tree/checktemplateverify-v22.0 with present commit hash 4d2c39314834a28cd46da943a12300cca8ffcb10, if you need to assist with testing.

On September twenty third 2022 AJ Cities posted on the Bitcoin Core OP_CTV pull request:

Should not this be:

m_bip119_c_s = (f != nullptr ? f : single_threaded);

or one thing? In any other case nothing appears to be performed with the bip_119_cache_synchronizer_t f that was handed in aside from typically asserting that it is nullptr.

Jeremy Rubin later responded:

Superb catch, I feel this ought to be eligible for the bipbounty.org bounty as a Main?

A Main reward was outlined on bipbounty.com as “One thing that must be mounted earlier than launch of CTV. Doesn’t require modifications to the BIP” and was entitled to a 0.1 BTC – 0.25 BTC payout. I am personally uncertain whether or not it was claimed or not.