Liquid Network — $320M L-BTC Mint via Range-Proof Cache-Key Collision

What it is

This is CertiK's forensic reconstruction of the exact byte-level collision behind the Liquid Network exploit, plus a full transaction-by-transaction timeline and the ongoing dispute over whether Blockstream's patch (Elements v23.3.4) actually closes the flaw. The existing summary states the collision happened in a four-part cache key from commit c26d719; this page supplies the mechanism and the receipts.

How it works

Elements caches range-proof verification results to avoid repeating expensive cryptographic checks. The cache lookup happens before commitment parsing and secp256k1_rangeproof_verify — a cache hit returns true immediately, skipping verification entirely. Commit c26d719 ("fix: range proof cache bind to asset and scriptpubkey") tried to strengthen the key by concatenating four variable-length fields (range-proof bytes, value commitment, asset generator, output script) with no delimiters between them. Because boundaries between variable-length fields are unmarked, shifting where one field ends and the next begins lets two unrelated verification inputs reduce to the identical byte stream. CertiK found the attacker's valid setup output and the invalid attack output both reduce to the same 4,301-byte stream, producing the same cache entry for two different verification inputs — one legitimate, one capable of minting unbacked L-BTC.

Critically, CertiK confirmed the pre-patch two-part key (proof || commitment) does not collide for these transactions — the vulnerability was introduced by the "fix" itself, not the original long-standing cache design.

Preconditions / Affected

Requires a node running the c26d719-era cache construction with a primed cache — a fresh valid transaction must first populate the ambiguous cache entry before the invalid output is checked. CertiK traced two setup transactions at 13:52:10 UTC and the inflation transaction 60 seconds later (13:53:10 UTC, block 4,050,336), but the specific transaction that primed the live cache on each accepting functionary node remains unidentified.

What to do

Blockstream shipped emergency patch Elements v23.3.4, described as hardening range-proof cache keys, reviewed by Bitcoin Red Team and Alpen Labs. Liquid resumed block production September 10 with peg-outs still disabled as a precaution, pending further testing/AI-assisted code scanning. No code or config action is specified beyond upgrading to v23.3.4.

Caveats

A post-incident technical write-up (unnamed on the page) argues the v23.3.4 replacement still permits a related ambiguity — the fix is disputed, not confirmed closed. Adam Back stated the root cause was an incorrect fix for an AI-found issue rated non-critical, compounding with a second non-critical issue. Dr. Calle claims a prior warning was ignored but is withholding details pending Blockstream's postmortem. Of the ~4,000 BTC taken, 3,400 BTC was returned and 598.49955894 BTC was kept as "change" to the same actor-controlled address — Taylor Monahan disputes the "whitehat" framing given the partial, self-dealt return.