{
  "id": 19827593,
  "title": "What auditing a Bitcoin 0.1.0 fork in 2026 turned up",
  "url": "https://urgent.news/2026/11/13/what-auditing-a-bitcoin-0-1-0-fork-in-2026-turned-up",
  "topic": "finance",
  "section": "Finance & Markets",
  "published": "2026-11-13T15:43:18.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/bitflash/what-auditing-a-bitcoin-010-fork-in-2026-turned-up-39a2"
  },
  "original_language": "en",
  "account": "In 2026, a thorough auditing of the Bitcoin 0.1.0 fork, known as Bitflash, revealed several significant findings. The fork, which started from the original 2009 Bitcoin release and used modern toolchains, replaced the proof of work mechanism with RandomX and eliminated IP addresses, making all nodes Tor onion services.\n\nTo conduct the audit, the team utilized a variety of open-source tools, including CodeQL, cppcheck, clang-tidy, the Clang Static Analyzer, flawfinder, and Semgrep for static analysis. For fuzzing, they employed 19 different harnesses, running them under libFuzzer, AFL++, and honggfuzz with AddressSanitizer and UndefinedBehaviorSanitizer. These tools shared a common corpus and were designed to run concurrently.\n\nAdditionally, the audit included instrumented self-tests for every verification process under ASan, ThreadSanitizer, and Valgrind. To ensure reproducibility, the audit script, run-audit.sh, built the node twice with varying time, locale, umask, and paths, and compared the resulting binaries.\n\nOne notable finding was the presence of a checksum in the P2P layer, which prevented fuzzers from feeding raw bytes to the network. This checksum's double-SHA256 calculation of payload messages allowed the first network harness to achieve 89% coverage of the envelope without reaching block or transaction handling. The second harness, which provided payloads after a simulated handshake, discovered real bugs, including a leak of duplicate blocks and a pool that released refused blocks twice.\n\nThe audit also uncovered discrepancies between Windows and Linux regarding consensus. A script number exceeding 2^32 was interpreted as 0 on Windows due to its 32-bit long data type, while Linux recognized it as INT_MAX. Scripts OP_PICK, OP_ROLL, and OP_CHECKMULTISIG were affected by this issue, which would have resulted in a network split if left unresolved.\n\nFurthermore, the audit discovered that a 2009 log buffer could lead to node deadlock. When a log line didn't fit, the NUL character appeared before the newline, preventing the buffer from draining, and causing the next vsnprintf to overwrite the mutex right after its creation. By analyzing a stuck pool using gdb and relinking unstripped objects to obtain symbols, the team found this issue. The audit also identified 711 leaks, most of which were false positives or were fixed with tests.\n\nIn summary, the audit of the Bitflash fork in 2026 uncovered critical issues related to the P2P layer, script number handling, and logging mechanisms. Despite some deferred actions, the audit demonstrated that the fork could be maintained without third-party intervention, with all findings and methods available for public scrutiny. The complete audit and code can be found at https://docs.bitflash.network/audit.html and https://github.com/bitflash-network/bitflash, respectively.",
  "summary": "Bitflash started from the source of Bitcoin 0.1.0, the 2009 release, ported to a modern toolchain. Two parts were replaced: proof of work is RandomX, and IP addresses are gone, so every node is a Tor onion service. Before release 1.2.33 we audited the whole node and published every finding. Here is what that looked like and what it found. The tooling Everything free and open: Static analysis:…",
  "key_points": [
    "Bitflash fork audit in 2026 reveals P2P layer checksum",
    "Script number overflow causes consensus discrepancies between Windows and Linux",
    "711 memory leaks identified, most fixed with tests"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}