Code, math and physics are my passion ∑ Working as a Bitcoin security researcher
in your mind
Joined November 2021
- Tweets729
- Following621
- Followers356
- Likes3K
E r i c k λ retweeted
Erick Cestari (@iamflops) posted to Delving Bitcoin the responsible disclosure of two denial-of-service (DoS) vulnerabilities in the channel opening process of Eclair v0.14.0 and earlier...
bitcoinops.org/en/newsletter…
E r i c k λ retweeted
‼️ Linus Torvalds called rules against AI coding tools "UTTERLY STUPID" on the Linux kernel mailing list.
He says people he respects and calls intelligent do not shy away from using new tools.
E r i c k λ retweeted
How well do we understand the standards our software depends on?
At Vinteum’s latest Deep Dive, Bitcoin developers spent a week opening the black boxes behind modern wallets: BIP 32, descriptors, Miniscript, PSBTs, and hardware signers.
Here’s what we learned: blog.vinteum.org/inside-a-vi…
E r i c k λ retweeted
We found two new bugs with bitcoinfuzz (one is a DoS) by just bumping the modules to latest master (we periodically do it) and running the CI with our corpora.
E r i c k λ retweeted
LDK 0.1.13, 0.2.7, and 0.3-rc3 are now available, with fixes for several security vulnerabilities, including fund theft.
If you run LDK in production with untrusted channel counterparties, we recommend upgrading today. If you’re testing 0.3, update to rc3.
1/4
E r i c k λ retweeted
Vinteum fellow @IsaqueFranklin0 presented "Limbs, carries and reduction: field elements in libsecp256k1" at @tabconf today.
The talk built a mental model of how libsecp256k1 represents 256-bit numbers as 5x52 field elements. Want to know more about it? The written deep dive behind it covers the same ground:
harlock.xyz/deep-dive-into-m…
E r i c k λ retweeted
Bitcoin privacy is not binary. It’s a contest over inference.
In our latest Deep Dive, we studied the transaction graph from both sides: how chain analysts narrow the set of plausible explanations, and how privacy techniques keep more than one alive.
vinteum.org/blog/inside-a-vi…
E r i c k λ retweeted
I wrote a blog post on the recent exploits in the Bitcoin ecosystem, how Bitcoin Core is holding up, and how I think the community can get ahead of the models:
dergoegge.de/blog/somethings…
E r i c k λ retweeted
Vinteum Grantee Spotlight: @Erik17192799
He spent the past year maturing @getfloresta into a secure, reliable, and reusable Bitcoin node implementation, while advancing Swift Sync, compact filters, and mobile performance.
More in Vinteum’s Report: vinteum.org/4
E r i c k λ retweeted
Vinteum Grantee Spotlight: @plebhash
From Bitcoin Core IPC integration to Job Declaration and the Stratum V2 Working Group, Plebhash has been working on the infrastructure needed to bring @StratumV2 into production.
More from our fourth year: vinteum.org/4
E r i c k λ retweeted
Discussed:
Bitcoin mining w/@avg_gary
Vulnerability discovery w/Erick Cestari (@iamflops)
Quantum topics w/@conduition_io
Covenants w/Greg Sanders (@theinstagibbs)
Average_gary (@avg_gary), Erick Cestari (@iamflops), Conduition (@conduition_io), and Greg Sanders (@theinstagibbs) joined Optech to discuss Newsletter #421:
News
● Using silent payments for miner payouts in coinbase transaction (2:19)
● Responsible disclosure of a denial-of-service vulnerability in CLN (27:42)
Changing consensus
● Continued discussion of PQC output types (54:03)
● DropKick commit/reveal PQC rescue (1:14:08)
● SHRINCS draft BIP (1:35:48)
● BIP448 and CSFS/CTV demos and applications (37:55)
Releases and release candidates
● Core Lightning 26.06.7 (1:51:35)
● LND v0.21.3-beta (1:55:32)
● LND v0.20.4-beta (1:55:37)
Notable code and documentation changes
● Bitcoin Core #36111 (1:58:21)
● Bitcoin Core #36032 (2:01:17)
● Core Lightning #9435 (2:04:52)
● Eclair #3368 (2:08:10)
● Eclair #3366 (2:10:54)
● LND #11090 (2:14:55)
● LND #11140 (2:20:33)
● HWI #792 (2:23:55)
● BDK #2262 (2:25:48)
E r i c k λ retweeted
Welcome to our live show! xitter.cf/i/broadcasts/1yKAPwOgD…
E r i c k λ retweeted
Core Lightning 26.06.7 is out and recommended for every node runner.
It fixes vulnerabilities reported over the past three weeks, during a sharp rise in AI-generated reports across open source Bitcoin. Details stay under embargo for two weeks, then all published.
github.com/ElementsProject/l…
E r i c k λ retweeted
Vinteum’s fourth year was about becoming a more durable organization.
Supporting established contributors. Helping emerging developers move toward sustained open-source careers. Strengthening the systems around that work.
The Year Four Report is out.
vinteum.org/blog/vinteum-yea…
I've written my first public vulnerability disclosure, detailing a DoS vulnerability I found in Core Lightning.
An attacker can crash a node simply by opening a connection and flooding it with ping messages.
Blog post: erickcestari.dev/blog/ping-f…
Delving: delvingbitcoin.org/t/disclos…
E r i c k λ retweeted
Eclair v0.14.2 is out: github.com/ACINQ/eclair/rele… 🚀⚡️
If you've been following AI scanning results recently, you already know that this is a good time to update your node 😉
E r i c k λ retweeted
Looks like a severe Core Lightning (CLN) issue was discovered.
It sounds like you should consider restarting your CLN node with `--offline` and be on the lookout for the point release coming in the next few days. (Messages from CLN discord via stacker.news/items/1555439).
E r i c k λ retweeted
More than a year after our first Bitcoin Dev Launchpad cohort, the paths are clearer.
Alumni are now working across Bitcoin open source through independent grants, full-time engineering roles, and long-term contributions.
Here’s where BDL1 took them ↓
vinteum.org/blog/bitcoin-dev…
E r i c k λ retweeted
I traced the Bitcoin Core multiprocess binaries (bitcoin-node and bitcoin-wallet) and wrote 3 posts on how it works under the hood.
viniciuscestari.dev/posts/in…
Turns out I wrote 3 posts to explain one line of C++, because of everything it hides.