Skip to content

Running v1.2.0 or earlier? Upgrade now — those nodes accept spends without a signature #54

Description

@Bitflash-sh

If the version in your title bar is v1.2.0 or lower, stop and upgrade before you do anything else: https://github.com/Bitflash-sh/bitflash/releases/latest

Most copies of Bitflash downloaded so far are one of those early builds. There is no automatic update, so this notice is the only way you would find out.

What is wrong with those versions

They accept a transaction that spends coins without a valid signature. Anyone can craft one. It is inherited from the Bitcoin 0.1.0 code this project is derived from, and it was fixed upstream in Bitcoin 0.3.5. The full technical description is in #15.

What that means for you in practice

Upgraded nodes reject those spends; your old node accepts them. The moment such a transaction appears, your node is on a different chain from everyone else. From inside, nothing looks wrong — the node keeps running, keeps showing a balance, keeps counting blocks.

  • If you mine: your blocks build on a chain the rest of the network throws away. The coins show up in your wallet and are worth nothing.
  • If you receive payments: you can see a payment confirm that no one else ever saw.

Nothing about this is visible from the interface. That is the whole problem.

Upgrading without losing your wallet

Your coins live in wallet.dat. Follow this in order.

1. Close Bitflash and make sure it is really gone.

On Windows, check Task Manager for Bitflash.exe. On Linux, run:

ps -eo pid,cmd | grep bitflash

Builds before v1.2.6 could fail to shut down cleanly and leave the wallet not fully written to disk. Copying while the program is still alive is how people end up with a file that will not open.

2. Copy the whole data folder, not just wallet.dat.

Windows %APPDATA%\Bitflash
Linux ~/.bitflash

Paste it somewhere safe — an external drive, another machine. Take the entire folder. On versions before v1.2.6, wallet.dat on its own may refuse to open on another computer, because the database keeps state in the files sitting next to it. Copying the folder avoids the whole problem. This is issue #40.

3. Install the new version.

Every version reads the same data folder, so there is nothing to migrate. Unzip over the old install, or put the new binary in place, and start it. Your balance and addresses will be there.

4. Check what you downloaded.

Each release ships a SHA256SUMS file. Windows PowerShell:

Get-FileHash Bitflash-1.2.7-windows.zip -Algorithm SHA256

Linux:

sha256sum -c SHA256SUMS

If a number does not match, do not run the file, and open an issue.

While you are upgrading

Everything since v1.2.1 is in the release notes, but three of them matter if you have been running an old build:

If anything here does not match what you are seeing, say so in this issue. Reports of "it just sits there doing nothing" have been the most useful thing anyone has sent — three of the fixes above started that way.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions