CVE-2023-50428

Name of the Vulnerable Software and Affected Versions Bitcoin Core versions prior to 26.1 Bitcoin Knots versions prior to 25.1.knots20231115

Description Datacarrier size limits can be bypassed by obfuscating data as code, such as using OP FALSE OP IF. This issue was exploited in the wild by Inscriptions during 2022 and 2023. The datacarriersize setting was intended to limit the size of data in carrier transactions, but it only restricted OP RETURN script sizes and did not limit witness data or other methods of encoding data. While the Bitcoin Knots project classifies this as a vulnerability, other parties consider it a design choice rather than a bug.

Recommendations Update Bitcoin Core to version 26.1 or later. Update Bitcoin Knots to version 25.1.knots20231115 or later.