Doug Huff [ARCHIVE] on Nostr: 📅 Original date posted:2011-06-27 🗒️ Summary of this message: A bug in the ...
📅 Original date posted:2011-06-27
🗒️ Summary of this message: A bug in the trade matching code of mtgox.com allows users to withdraw all USD funds after placing a buy order that will drain their account.
📝 Original message:Begin forwarded message:
> From: Doug Huff <mith at jrbobdobbs.org>
> Date: June 27, 2011 9:46:13 PM CDT
> To: full-disclosure at lists.grok.org.uk, "Mt.Gox" <info at mtgox.com>
> Cc: Bitcoin Dev Development <bitcoin-development at lists.sourceforge.net>
> Subject: Live mtgox.com trade matching bug.
>
> Step 1: Have USD available for spending on mtgox.com.
> Step 2: Put in a buy order large enough to drain your account. Low enough under the current trading price that it will not execute immediately.
> Step 3: Withdraw all USD funds.
> Step 4: Wait for market to fall enough to meet your order.
> Step 5: ...(self explanatory)...
>
> There's a bit of luck in being able to take advantage, obviously.
>
> I would suggest you take the site down asap until this is corrected or publicly show how this order will never execute:
>
> ==========
> Welcome <username removed> 0.00000000 ฿TC 424.44901
> Buying 138468.901 0.01 Active 1384.69 06/26 15:27 cancel
> ==========
>
> I cannot guarantee this order will execute but from everything I've observed about the new trade matching code I have no reason to believe it will not.
>
> At the very least this could be used to influence market conditions if it is only a display bug.
>
> --
> Douglas Huff
>
>
--
Doug Huff
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3737 bytes
Desc: not available
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110627/d3cb2cbe/attachment.p7s>;
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 881 bytes
Desc: This is a digitally signed message part
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110627/d3cb2cbe/attachment.sig>;
🗒️ Summary of this message: A bug in the trade matching code of mtgox.com allows users to withdraw all USD funds after placing a buy order that will drain their account.
📝 Original message:Begin forwarded message:
> From: Doug Huff <mith at jrbobdobbs.org>
> Date: June 27, 2011 9:46:13 PM CDT
> To: full-disclosure at lists.grok.org.uk, "Mt.Gox" <info at mtgox.com>
> Cc: Bitcoin Dev Development <bitcoin-development at lists.sourceforge.net>
> Subject: Live mtgox.com trade matching bug.
>
> Step 1: Have USD available for spending on mtgox.com.
> Step 2: Put in a buy order large enough to drain your account. Low enough under the current trading price that it will not execute immediately.
> Step 3: Withdraw all USD funds.
> Step 4: Wait for market to fall enough to meet your order.
> Step 5: ...(self explanatory)...
>
> There's a bit of luck in being able to take advantage, obviously.
>
> I would suggest you take the site down asap until this is corrected or publicly show how this order will never execute:
>
> ==========
> Welcome <username removed> 0.00000000 ฿TC 424.44901
> Buying 138468.901 0.01 Active 1384.69 06/26 15:27 cancel
> ==========
>
> I cannot guarantee this order will execute but from everything I've observed about the new trade matching code I have no reason to believe it will not.
>
> At the very least this could be used to influence market conditions if it is only a display bug.
>
> --
> Douglas Huff
>
>
--
Doug Huff
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3737 bytes
Desc: not available
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110627/d3cb2cbe/attachment.p7s>;
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 881 bytes
Desc: This is a digitally signed message part
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110627/d3cb2cbe/attachment.sig>;