Live mtgox.com trade matching bug.
6 messages, 28 Jun 2011. Started by Douglas Huff.
Douglas Huff (2), Mike Hearn (2), Luke Dashjr, Matt Corallo
Begin forwarded message:
Quoted text (29 lines)
> From: Doug Huff <mith@jrbobdobbs•org> > Date: June 27, 2011 9:46:13 PM CDT > To: full-disclosure@lists•grok•org•uk, "Mt.Gox" <info@mtgox•com> > Cc: Bitcoin Dev Development <bitcoin-development@lists•sourceforge•net> > Subject: Live mtgox.com trade matching bug. > > Step 1: Have USD available for spending on mtgox.com. > Step 2: Put in a buy order large enough to drain your account. Low enough under the current trading price that it will not execute immediately. > Step 3: Withdraw all USD funds. > Step 4: Wait for market to fall enough to meet your order. > Step 5: ...(self explanatory)... > > There's a bit of luck in being able to take advantage, obviously. > > I would suggest you take the site down asap until this is corrected or publicly show how this order will never execute: > > ========== > Welcome <username removed> 0.00000000 ฿TC 424.44901 > Buying 138468.901 0.01 Active 1384.69 06/26 15:27 cancel > ========== > > I cannot guarantee this order will execute but from everything I've observed about the new trade matching code I have no reason to believe it will not. > > At the very least this could be used to influence market conditions if it is only a display bug. > > -- > Douglas Huff > >
Hi Doug,
Could we keep the Mt Gox related stuff off bitcoin-development please? It's not related to the core software.
On Tue, Jun 28, 2011 at 4:48 AM, Doug Huff <dhuff@jrbobdobbs•org> wrote:
Quoted text (51 lines)
> > > Begin forwarded message: > >> From: Doug Huff <mith@jrbobdobbs•org> >> Date: June 27, 2011 9:46:13 PM CDT >> To: full-disclosure@lists•grok•org•uk, "Mt.Gox" <info@mtgox•com> >> Cc: Bitcoin Dev Development <bitcoin-development@lists•sourceforge•net> >> Subject: Live mtgox.com trade matching bug. >> >> Step 1: Have USD available for spending on mtgox.com. >> Step 2: Put in a buy order large enough to drain your account. Low enough under the current trading price that it will not execute immediately. >> Step 3: Withdraw all USD funds. >> Step 4: Wait for market to fall enough to meet your order. >> Step 5: ...(self explanatory)... >> >> There's a bit of luck in being able to take advantage, obviously. >> >> I would suggest you take the site down asap until this is corrected or publicly show how this order will never execute: >> >> ========== >> Welcome <username removed> 0.00000000 ฿TC 424.44901 >> Buying 138468.901 0.01 Active 1384.69 06/26 15:27 cancel >> ========== >> >> I cannot guarantee this order will execute but from everything I've observed about the new trade matching code I have no reason to believe it will not. >> >> At the very least this could be used to influence market conditions if it is only a display bug. >> >> -- >> Douglas Huff >> >> > > -- > Doug Huff > > > > ------------------------------------------------------------------------------ > All of the data generated in your IT infrastructure is seriously valuable. > Why? It contains a definitive record of application performance, security > threats, fraudulent activity, and more. Splunk takes this data and makes > sense of it. IT sense. And common sense. > http://p.sf.net/sfu/splunk-d2d-c2 > _______________________________________________ > Bitcoin-development mailing list > Bitcoin-development@lists•sourceforge•net > https://lists.sourceforge.net/lists/listinfo/bitcoin-development > >
On Tuesday, June 28, 2011 2:35:59 AM Mike Hearn wrote:
Quoted text (2 lines)
> Could we keep the Mt Gox related stuff off bitcoin-development please? > It's not related to the core software.
MtGox's code is just as related as BitcoinJ or any other Bitcoin software, IMO.
Quoted text (5 lines)
>> Could we keep the Mt Gox related stuff off bitcoin-development please? >> It's not related to the core software. > > MtGox's code is just as related as BitcoinJ or any other Bitcoin software, > IMO.
It's closed source, so nobody here can do anything about it (unlike other software discussed here).
On Tue, 2011-06-28 at 11:52 +0200, Mike Hearn wrote:
Quoted text (8 lines)
> >> Could we keep the Mt Gox related stuff off bitcoin-development please? > >> It's not related to the core software. > > > > MtGox's code is just as related as BitcoinJ or any other Bitcoin software, > > IMO. > > It's closed source, so nobody here can do anything about it (unlike > other software discussed here).
And this is also no where near the right place to be disclosing security vulnerabilities. Whether you like the guy/site or not, keep those prive for a reasonable amount of time for them to be fixed (that means more than an hour).
Matt
Begin forwarded message:
Quoted text (23 lines)
> From: Doug Huff <dhuff@jrbobdobbs•org> > Date: June 27, 2011 11:28:28 PM CDT > To: Gavin Andresen <gavinandresen@gmail•com> > Subject: Re: [Bitcoin-development] Fwd: Live mtgox.com trade matching bug. > > Already talked to Jeff and agreed to stop posting them here. There is just currently no other forum for such reports. I think he was going to talk to you about starting a bitcoin-vendor-sec or similar list. > > I agree it does not belong there. > > On Jun 27, 2011, at 11:22 PM, Gavin Andresen wrote: > >> The bitcoin-development list is for discussion of core bitcoin >> development, not about Mt.Gox or other sites or software that uses >> bitcoin. >> >> -- >> -- >> Gavin Andresen > > -- > Doug Huff > >