Bitcoin Core 32 is almost here, and an AI found one of its bugs

Bitcoin Core 32.0 was supposed to ship on October 10. It didn't. As of mid-October it was on its fourth release candidate, which honestly is how it should be. Nobody wants a rushed release of the software that half the network runs on.

I went through what's actually in it, and there's more interesting stuff than I expected for a release that doesn't touch consensus at all. So here's the short version.

Nothing about the rules changes#

Worth saying first because people always ask. 32.0 doesn't change what counts as a valid block or transaction. No soft fork, nothing to activate. It's all about how the node software works, not what bitcoin is.

Fee estimates that don't overpay as much#

This is the part most people will actually feel.

Until now, Core figured out what fee to suggest mostly by looking at what got into recent blocks. Which works, but it's slow to react. When the mempool clears out after a busy stretch, the estimator keeps recommending high fees for a while because it's still looking at the past.

Version 32 adds a second estimator that looks at what's sitting in the mempool right now. Core compares both and can suggest the lower fee when current conditions support it.

So when congestion drops, your wallet should notice sooner. Not a huge deal for one transaction, but if you consolidate UTXOs or send often, it adds up.

Faster syncing#

When a node checks a block, it has to pull transaction data from disk, and a lot of time used to go into just waiting for that. 32.0 fetches it using multiple threads, eight by default.

If you've ever synced a node from scratch on a normal machine, you know how long it takes. Anything that cuts the waiting is welcome.

Smaller thing but nice: if you run with txindex, it'll take less than half the disk space after a full rebuild.

Two security fixes, one found by an AI#

This is the part I found most interesting.

The first one has been around since version 24. On non-Windows systems, if you had walletnotify enabled, someone with permission to create wallets could run commands on your machine with a carefully crafted wallet name. Pretty specific setup, but still not something you want sitting in your node for years.

The second one is in a brand-new HTTP server that 32.0 introduces to replace the old one. It was found during an audit that used an AI model, and testing showed it also reached the REST interface, which doesn't need a login. Because that server never shipped in a stable release, nobody running an official version was ever exposed. It got caught before it went out.

I think that's worth noticing. People argue a lot about AI writing code. Here it was used to check code, and it found something real in software that secures a lot of money. That's probably where it's most useful for now.

PSBT version 2 becomes the default#

A few Core commands that build partially signed transactions will now use the newer PSBT v2 format by default. If you just use a hardware wallet with some app, you won't notice anything. If you run tools built directly on those Core commands, check that they handle v2. The old format can still be requested.

Should you upgrade?#

If you run a node, yes, once the final version is out. Better fees, faster sync, a long-standing bug fixed. Just download it from bitcoincore.org and check the signatures, like always.

And if you don't run a node yet, this is a pretty good reminder of why it's worth it. All this work happens in the open, for free, so anyone can check the rules for themselves instead of trusting someone else's server.