Hi Insiders. This is Tuma, open-source reporter from the Insider Edition.

In this week update we feature Fedimint exposing APIs for atomic swaps, the Cashu Development Kit (CDK) adding support for Iroh, and Marmot upgrading to version 2 of the messaging protocol.

We also cover several important news from the Bitcoin ecosystem. We discuss the current effort by the Red Team to find vulnerabilities in Bitcoin related project and responsibly disclosing them to maintainers, Boltz stopping its swap service, a critical bug in BTCPayServer, and the BIP110 fork.

#

Highlights from the bitcoin developer ecosystem

I spent 10+ hours in open-source developer calls in the Bitcoin ecosystem last week. Here is what caught my eye:

• PR8913 is exposing APIs for raw Hashed Time-Locked Contracts (HTLCs) APIs in Fedimint.

  • During the weekly call, on Monday 3rd, Fedimint developer discussed PR8913, a new feature providing raw HTLCs APIs. This feature has been widely requested by the community, and the PR, which is still in draft, is addressing this need.
  • The main goal for exposing such an interface is to enable atomic swaps between fedimint ecash and other Bitcoin layers, such as Ark, Cashu, and even Bitcoin on-chain.
  • While the mechanism is already implemented in the Lightning module LNv2, the APIs are not yet exposed to the clients in its raw form.

• PR2285 in the Cashu Development Kit (CDK) is adding support for Iroh.

  • During the weekly call, on Wednesday 5th, CDK contributors discussed PR2285, which aims to introduce a new crate to support Iroh.
  • Iroh is a P2P transport layer for fast and reliable connection between devices. Instead of relying on IP addresses, every Iroh endpoint is actually a cryptographic key.
  • The new feature would allow mints and wallets to communicate over Iroh, instead of relying only on HTTP. The PR introduces a new iroh:// URL scheme so wallets can connect to mints through their public key.

• Marmot has been officially upgraded to the version 2 of the protocol.

  • During the monthly call, on Tuesday 4th, Marmot developers discussed the official upgrade to version 2 of the messaging protocol based on Nostr and Messaging Layer Security (MLS). The new specifications are organized according to the protocol surface, effectively deprecating the precious MIP-based approach.
  • The new version aims to make the protocol more stable, mainly from the group consensus point of view (message ordering, user additions/removals, etc.), allowing each user to reach the same state deterministically. It also aims to make Marmot agnostic with respect to the transport layer.
  • Marmot v2 is currently being integrated in the White Noise client. Its release is expected soon, promising a smoother, faster, and more stable experience.

A BIPs Update

There was no newsworthy update in the last days in the BIP repository. We’ll provide new updates as soon as a new BIP gets published or gets assigned a number.

Other News from the Bitcoin World

• The Red Team: Following the COLDCARD incident, a group of developers announced a huge red teaming operation to find critical vulnerabilities affecting Bitcoin-related software.

  • The effort, lead by AncorWatch CEO Rob Hamilton, is currently ongoing. According to the last report, the team has discovered around 8000 vulnerabilities, with more the 1200 of critical or high severity level. Bugs are being responsibly disclosed to the various project maintainers.
  • The Red Team is making heavy use of LLMs to discover vulnerabilities, in particular leveraging the frontier, open-weight model Kimi K3. As of today, this is probably the only model able to dive into cybersecurity issues without hitting those limits introduced by producers.
  • As of today, devs focused on red teaming Bitcoin have spent tens of thousand dollars in LLM tokens to bring on their work. Many people have already donated to the cause, while no-profits as OpenSats have launched specific funds to provide grants to people assessing security of Bitcoin software.

• Boltz stopped: On Monday, August 3rd, Boltz announced that they were stopping their service until further notice. As of today, operations haven’t got back to normal yet.

  • According to the Boltz team, the decision came after months of continuous exploits from AI-assisted and automated attacks to their infrastructure. While no users’ funds were stolen, Boltz itself incurred in losses as a result of the attacks.

• Critical bug in BTCPayServer: On Friday, August 7th, the BTCPayServer team announced a vulnerability in their software was actively being exploited by attackers, resulting in loss of funds.

  • The critical bug affects those instances of BTCPayServer (version < v2.4.2) running with an LND Lightning node. The issue allows an attacker to obtain the .macaroon credentials for the node without authenticating. Those credentials can be used to take full control of the LND node, effectively letting a remote attacker move funds.
  • Check BTCPayServer’s security advisory for more information and migration guides. We recommend any user with running an instance to upgrade immediately to v2.4.2.

• BIP110 forked: On Saturday, August 8th, at block height 961632 the period for mandatory signaling for activation of BIP110 began.

  • Block 961632 was mined by AntPool. The pool did not signal for BIP110, effectively rejecting the soft fork. Soon after, Ocean mined a block signaling for activation, thus creating a chain-split.
  • The legacy chain soon took up steam, with new blocks coming regularly. On the other hand, miners on the BIP110 chain were able to only mine another block. Later on, hashrate on the BIP110 chain moved back to the legacy one. BIP110 did not activate.

• Proposal to remove Luke Dashjr from BIP editor: Following the failure of the BIP110 activation, Murch launched a motion to remove Luke Dashjr from the role of BIP editor. The proposal is based on several factors: lack of involvement in the BIP processes, decisions taken over BIP110 with conflict-of-interest concerns, and break of trust and communication with the other editors.

• Coinswap protocol: CitadelFOSS is close to release their implementation of the Coinswap protocol, the foundation for a decentralized atomic-swap marketplace. The protocol is nearly ready for a launch on mainnet, and the developers are actively looking for wallets willing to integrate it in their stack. According to the team, they ready to provide any tech assistance, and the integration requires a few simple API calls.

#

Looking for an opportunity to join up with some bitcoin devs in person? Join us in Berlin this October 1- 3 to talk about payments in Bitcoin!