Audit report AR-06

Reported privately in an independent security review, 2026-08-07.

Report date

2026-08-07

Kind

Test

Status on master

Present

Proposed issue state

Open

Summary

The report says libmultiprocess has no fuzz target for its protocol or codecs, and that its sanitizer CI runs only ThreadSanitizer, with no AddressSanitizer, MemorySanitizer or UndefinedBehaviorSanitizer job. The fuzzing half is right: neither libmultiprocess nor Bitcoin Core fuzzes the IPC layer. The sanitizer half is not: ASan and UBSan jobs already ran against libmultiprocess at the commit the report examined, and Bitcoin Core's CI runs ASan, MSan and TSan with IPC enabled. Test-coverage idea.

The report

An informational note. It observes that the dedicated sanitizer configuration (ci/configs/sanitize.bash) runs ThreadSanitizer, that it found no standalone ASan, MSan or UBSan jobs, and that no protocol or parser fuzz target exists in the repository tree. It adds that its four standalone memory models (see AR-01, AR-02, AR-03 and AR-13) all fail under ASan, which it presents as evidence that ASan would be worth adding to CI. The remediation list ends with "Add ASan/UBSan/MSan and protocol fuzzing to CI".

Proposed change

Add ASan, UBSan and MSan jobs and protocol fuzzing to CI. No code or design.

Assessment

• ci/configs/sanitize.bash is indeed TSan-only, but it is not the only sanitizer CI. libmultiprocess's .github/workflows/bitcoin-core-ci.yml already had an "ASan + UBSan" job (-DSANITIZERS=address,float-divide-by-zero,integer,undefined, running Bitcoin Core's IPC unit and functional tests against the library) and an instrumented TSan job at the commit the report examined, 67302cd.
• Bitcoin Core's own CI runs native_asan (ASan with UBSan), native_msan and native_tsan configurations with ENABLE_IPC on, which is the default outside Windows. Several of the bugs in this survey were found by those jobs, and Antithesis also exercises IPC.
• The fuzzing point is partly out of date. libmultiprocess has no fuzz target, but Bitcoin Core has had an IPC fuzz target since bitcoin#35118 (src/ipc/test/fuzz/ipc.cpp), which drives a generated C++ client and server; bitcoin#35916 extends it. Neither feeds the server arbitrary messages the C++ client could not produce.

The four ASan failures the report cites come from standalone programs that re-implement a pattern with plain new/delete or malloc/free; they do not exercise the library, so they say nothing about whether the existing ASan jobs would catch those patterns.

A fuzz target that feeds arbitrary Cap'n Proto messages to a generated server (for example libmultiprocess's test FooInterface, or Bitcoin Core's Echo and Mining interfaces) would exercise the input-reading paths behind AR-10 (enum values), AR-13 (throwing reads) and AR-27 (malformed JSON, since fixed).

Status

Sanitizer coverage already exists; no action needed there. A fuzz harness that sends arbitrary Cap'n Proto messages, beyond what the generated C++ client produces, is still an open idea; the existing target and bitcoin#35916 are the natural starting point.

Reported privately in an independent security review on 2026-08-07.