Skip to content

Instantly share code, notes, and snippets.

@robbielite
robbielite / litecoin-core-0.21.5.4-audit-findings.md
Last active May 2, 2026 02:02
Litecoin Core 0.21.5.4 audit findings

Litecoin Core 0.21.5.4 Audit Findings

Date: 2026-05-02
Scope: Litecoin Core 0.21.5.4, docker-litecoin-core 0.21 images, and reviewed Electrum-LTC macOS artifact notes.
Status: Findings and local patch suggestions from a focused security/correctness/release-engineering audit.

Executive Summary

The most urgent known MWEB consensus issue appears addressed in Litecoin Core 0.21.5.4, but the audit found several security-adjacent correctness and release-process issues that should be patched or reviewed by maintainers. The highest-priority items are macOS release validation gaps, stale MWEB transaction state on object reuse, incorrect binary-verifier infrastructure, uninitialized versionbits override heights, and Docker supply-chain weaknesses.

### Keybase proof
I hereby claim:
* I am robbielite on github.
* I am r_f_c (https://keybase.io/r_f_c) on keybase.
* I have a public key ASAGDPmiCLIYeJEF8pCEkPN4XcX-5oeINCSUZwz1hFK2AQo
To claim this, I am signing this object: