Micro-transaction Vulnerability Patched
A denial-of-service vector involving dust transactions is discovered and patched in version 0.3.13.
On September 29, 2010, Bitcointalk user kermit discovered a vulnerability in how the Bitcoin protocol handled micro-transactions (extremely small amounts of bitcoin, often called 'dust'). The flaw allowed an attacker to flood the network with thousands of valid but economically meaningless transactions that would clog the memory pools of nodes and potentially crash the software. Unlike the Value Overflow bug (which threatened the money supply), this was a Denial of Service (DoS) vector that threatened network uptime.
In response, Satoshi Nakamoto and the development team released Bitcoin v0.3.13. This update introduced the concept of a minimum relay fee (or `min tx fee`) for transactions smaller than a certain byte size. This was a controversial but necessary change; it effectively meant that 'free' transactions were no longer guaranteed. It introduced an economic cost to spamming the network. If you wanted to send a transaction that burdened the network's RAM, you had to pay for it.
This event marked the first steps toward a fee market. It forced the community to confront the reality that block space and node resources are scarce commodities that must be rationed, either by code rules or economic price. The discovery and patching of the micro-transaction vulnerability introduced the first anti-spam economic policies to the protocol, establishing the precedent that transaction processing requires a minimum cost to prevent abuse.
Key Sources:
• Bitcointalk: Kermit reports the bug
• CVE-2010-5141 Detail
• SourceForge: Commit Log for 0.3.13