Electrum released version 4.8.3 on Oct. 24 after disclosing a high-severity flaw that malicious servers were exploiting in the wild to substitute Bitcoin transactions and potentially redirect funds. The wallet said versions before 4.8.3 were affected, and that it had received two user reports, including one case in which a user lost funds after raising the fee on a substituted transaction.
Electrum 4.8.3 patches transaction-history signature validation
Electrum’s version 4.8.3 verifies signatures on unconfirmed transactions spending wallet-controlled coins before adding them to local transaction history, according to the project’s security advisory.
Electrum classified the vulnerability as high severity and said releases earlier than 4.8.3 are affected. The fix is intended to stop a server from introducing an invalid, conflicting transaction into a wallet’s transaction history during a critical stage of the payment flow.
Rogue servers substituted a conflicting payment before the RBF fee bump
The attack relied on a malicious Electrum server during a user’s attempt to increase the fee on a recently broadcast transaction through replace-by-fee, or RBF. Electrum said the server could replace the newly broadcast payment with a conflicting transaction that paid an attacker.
The user could then be prompted to sign an RBF fee increase for that replacement rather than for the original payment. In effect, the fee-bump action became the point at which the attacker-directed transaction could gain the user’s signature.
RBF is commonly used to accelerate an unconfirmed Bitcoin transaction by replacing it with a version that carries a higher fee. The reported vulnerability concerned how affected Electrum versions processed transaction information provided by their servers before the user signed that replacement.
Electrum confirms in-the-wild attacks and a reported loss
Malicious servers were carrying out the attack in the wild, Electrum said on Oct. 24. The project reported two user complaints, including one case in which a user lost funds after increasing the fee on a substituted transaction.
Users of releases before 4.8.3 were identified in Electrum’s advisory. The immediate step described in the reporting was to upgrade from older versions.
CoinDesk’s Oct. 26 report said at least one user had lost bitcoin and urged users to check recipient addresses and payment amounts before signing transactions.
