Liquid Network is getting closer to restoring Bitcoin peg out operations after starting an independent security audit of Elements v23.3.4 and updating the authorization keys used for withdrawals.
In its September 28 update, Liquid said an external security audit of Elements v23.3.4 is now underway. The audit is part of the network’s recovery plan following the September security incident.
At the same time, the Liquid Federation is replacing existing Peg out Authorization Key (PAK) entries and making sure the Bitcoin receiving keys used for peg outs are properly protected in cold storage.
Peg outs are still suspended, and Liquid has not announced a specific date for when Bitcoin withdrawals will restart. The network said the audit and PAK updates are important steps toward safely bringing the service back.
The security work follows the September 6 exploit, when an attacker created around 4,000 unbacked LBTC and used Liquid’s normal peg out process to withdraw Bitcoin from the federation reserve.
The vulnerability was linked to how Elements handled cached rangeproof verification results. A flaw in the cache key allowed verification results to be reused in situations where they should not have been, creating a consensus problem.
Elements v23.3.4 was released earlier this month to fix the issue. The update changed how rangeproof and surjection proof cache keys are created by adding length information to each field, preventing the type of cache collision used in the attack.
The fix was merged into the Elements 23.3.x branch on September 8, and version 23.3.4 was released the following day. Liquid is now having the software independently reviewed before peg outs are restored.
The PAK system is another major part of the recovery process. It is used to authorize Bitcoin withdrawals from Liquid to the Bitcoin network.
PAK entries contain separate keys for verification and signing. The federation is now replacing existing entries and working to ensure the relevant Bitcoin receiving keys are kept offline in cold storage.
During the September incident, the attacker used SideSwap, a Liquid Federation member with a PAK, to process the peg out. Around 3,996 BTC was eventually released from the federation reserve.
Liquid’s investigation identified two separate security problems: the Elements consensus vulnerability and a weakness in the configuration of one federation member’s PAK signing process.
SideSwap has said its authorization key had been operating online for years and that it had not been instructed to change the setup or suspend peg outs before the incident. The company said it was reviewing how the key is stored and strengthening the checks required before payouts.
Liquid has since continued its staged recovery. Block production resumed on September 9 after functionary nodes were updated, and normal user transactions later returned.
However, Bitcoin peg outs have remained disabled because they involve releasing BTC from the federation reserve.
The incident initially resulted in about 4,000 BTC leaving the reserve. Around 3,400 BTC was later returned to the federation wallet, while approximately 602 BTC remains subject to recovery efforts, according to Liquid’s incident assessment.
For now, the external audit of Elements v23.3.4 and the replacement of PAK entries are the latest steps toward restoring peg outs. Liquid said another update on the recovery process is expected soon, but it has not yet given a firm restart date.
