Olaoluwa Osuntokun

This account is verified. Learn more

@roasbeef

Half-man, half-beef. UCSB Computer Science MS+BS. CTO at @lightning labs. Bitcoin · Applied Cryptography · Distributed Systems · #golang · DC42612E89237182

San Francisco, CA github.com/roasbeef Joined May 2012

779 Following 41K Followers 8.1K Posts

Latest posts 5

Pinned post

Olaoluwa Osuntokun @roasbeef Oct 15

Announcing LayerTree: a new tree-based scaling solution for Bitcoin that permits O(1), independent of the number of users in the system: x.com/lightning/stat…

A single UTXO can hold the balance of millions of users as an off-chain Merkle-sum tree.

Transaction introspection techniques permit batched exit from the system in a single transaction w/o any pre-signing: layertree.tech

1:06

Lightning Labs⚡️🌐 Verified account @lightning Oct 15

Introducing LayerTree, a non-custodial scaling solution on bitcoin that connects to Lightning.

Using covenants, one UXTO can be shared by a million users. Any user can leave at any time in a single transaction. Users don't need to be online to receive. Funds never time out.

LayerTree is the next step in bringing bitcoin to billions.

Learn more: layertree.tech
View quoted post on X

Olaoluwa Osuntokun @roasbeef 4d

Georgios Konstantopoulos Verified account @gakonst 4d

incredible read h/t @0xalpharush

"If your program is a room full of sneaky little bugs, there's little to be gained by looking for them in a neighboring room!"

jhellerstein.github.io/blog/no-room-f…
View quoted post on X

Olaoluwa Osuntokun @roasbeef Oct 31

next.go?

Tim Verified account @timneutkens Oct 30

We're prototyping native language support in Next.js, starting with Route Handlers and Proxy in Go.

This gives you more options for CPU intensive workloads on the server, alongside your React app.

View quoted post on X

Olaoluwa Osuntokun @roasbeef Oct 30

these are prebuilt releases that turn off MPTCP for default listeners

the feature can also be disabled with this env variable: GODEBUG=multipathtcp=0

even with this version/env, the only sure-fire way to protect yourself is updating your Linux kernel

Olaoluwa Osuntokun Verified account @roasbeef Oct 30

lnd v0.20.7 and v0.21.6 have been released, which contain a Go-specific mitigation (MPTCP flag off) for CVE-2026-98432 (use-after-free in the Linux kernel's IPv4 TCP).

github.com/lightningnetwo…
github.com/lightningnetwo…

We recommend that all users update to this new version.

Existing binaries can be protected by running them with the GODEBUG=multipathtcp=0 env variable: github.com/golang/go/issu….

Note that as this is a Linux kernel level vulnerability, the only way to fully mitigate the vuln is to patch your kernel, as any network facing service may be affected (known PoCs use MPTCP, but other exploit vectors may be possible).
View quoted post on X

Olaoluwa Osuntokun @roasbeef Oct 30

lnd v0.20.7 and v0.21.6 have been released, which contain a Go-specific mitigation (MPTCP flag off) for CVE-2026-98432 (use-after-free in the Linux kernel's IPv4 TCP).

github.com/lightningnetwo…
github.com/lightningnetwo…

We recommend that all users update to this new version.

Existing binaries can be protected by running them with the GODEBUG=multipathtcp=0 env variable: github.com/golang/go/issu….

Note that as this is a Linux kernel level vulnerability, the only way to fully mitigate the vuln is to patch your kernel, as any network facing service may be affected (known PoCs use MPTCP, but other exploit vectors may be possible).

github.com Release lnd v0.21.6-beta · lightningnetwork/lnd ⚠️ Security: CVE-2026-98432 (Linux kernel) CVE-2026-98432 is a use-after-free in the Linux kernel's IPv4 TCP stack. It is not specific to MPTCP, but the demonstrated remote exploit requires an ...