Blockstream says the 3 August remediation for an earlier range-proof cache defect concatenated variable-length fields without length framing, introducing a second consensus bug later exploited on 6 September. Three review paths did not identify the defect. Ordinary transactions have resumed on the corrected chain, but the report’s latest cited public update, dated 17 September, said recovery testing remained in progress and peg operations had not been declared fully restored.
The active control issue now covers both recovery and remediation governance. Federated signing did not provide an independent reserve check once functionaries accepted a corrupted chain state, while one peg-out operator’s online key, automatic forwarding and absence of size or velocity limits removed an additional containment layer.
Action owners: Liquid Federation members, functionaries, Blockstream, SideSwap and other peg-out operators, exchanges and wallets supporting LBTC, tokenised-asset issuers, auditors, software-security teams, treasury and operational-risk teams and regulators.
Next checks: safe peg-out reactivation; full BTC/LBTC reserve reconciliation; recovery or disposition of approximately 602 BTC; independent technical and governance review; adoption of length-framed consensus cache controls; offline-key compliance; transaction limits, velocity checks and manual review for large peg-outs.