Mike Hearn [ARCHIVE] on Nostr: 📅 Original date posted:2011-06-28 🗒️ Summary of this message: A bug in Mt ...
📅 Original date posted:2011-06-28
🗒️ Summary of this message: A bug in Mt Gox's trade matching code allowed users to withdraw USD funds after placing a buy order that would drain their account.
📝 Original message:Hi Doug,
Could we keep the Mt Gox related stuff off bitcoin-development please?
It's not related to the core software.
On Tue, Jun 28, 2011 at 4:48 AM, Doug Huff <dhuff at jrbobdobbs.org> wrote:
>
>
> Begin forwarded message:
>
>> From: Doug Huff <mith at jrbobdobbs.org>
>> Date: June 27, 2011 9:46:13 PM CDT
>> To: full-disclosure at lists.grok.org.uk, "Mt.Gox" <info at mtgox.com>
>> Cc: Bitcoin Dev Development <bitcoin-development at lists.sourceforge.net>
>> Subject: Live mtgox.com trade matching bug.
>>
>> Step 1: Have USD available for spending on mtgox.com.
>> Step 2: Put in a buy order large enough to drain your account. Low enough under the current trading price that it will not execute immediately.
>> Step 3: Withdraw all USD funds.
>> Step 4: Wait for market to fall enough to meet your order.
>> Step 5: ...(self explanatory)...
>>
>> There's a bit of luck in being able to take advantage, obviously.
>>
>> I would suggest you take the site down asap until this is corrected or publicly show how this order will never execute:
>>
>> ==========
>> Welcome <username removed> 0.00000000 ฿TC 424.44901
>> Buying 138468.901 0.01 Active 1384.69 06/26 15:27 cancel
>> ==========
>>
>> I cannot guarantee this order will execute but from everything I've observed about the new trade matching code I have no reason to believe it will not.
>>
>> At the very least this could be used to influence market conditions if it is only a display bug.
>>
>> --
>> Douglas Huff
>>
>>
>
> --
> Doug Huff
>
>
>
> ------------------------------------------------------------------------------
> All of the data generated in your IT infrastructure is seriously valuable.
> Why? It contains a definitive record of application performance, security
> threats, fraudulent activity, and more. Splunk takes this data and makes
> sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-d2d-c2
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>
>
🗒️ Summary of this message: A bug in Mt Gox's trade matching code allowed users to withdraw USD funds after placing a buy order that would drain their account.
📝 Original message:Hi Doug,
Could we keep the Mt Gox related stuff off bitcoin-development please?
It's not related to the core software.
On Tue, Jun 28, 2011 at 4:48 AM, Doug Huff <dhuff at jrbobdobbs.org> wrote:
>
>
> Begin forwarded message:
>
>> From: Doug Huff <mith at jrbobdobbs.org>
>> Date: June 27, 2011 9:46:13 PM CDT
>> To: full-disclosure at lists.grok.org.uk, "Mt.Gox" <info at mtgox.com>
>> Cc: Bitcoin Dev Development <bitcoin-development at lists.sourceforge.net>
>> Subject: Live mtgox.com trade matching bug.
>>
>> Step 1: Have USD available for spending on mtgox.com.
>> Step 2: Put in a buy order large enough to drain your account. Low enough under the current trading price that it will not execute immediately.
>> Step 3: Withdraw all USD funds.
>> Step 4: Wait for market to fall enough to meet your order.
>> Step 5: ...(self explanatory)...
>>
>> There's a bit of luck in being able to take advantage, obviously.
>>
>> I would suggest you take the site down asap until this is corrected or publicly show how this order will never execute:
>>
>> ==========
>> Welcome <username removed> 0.00000000 ฿TC 424.44901
>> Buying 138468.901 0.01 Active 1384.69 06/26 15:27 cancel
>> ==========
>>
>> I cannot guarantee this order will execute but from everything I've observed about the new trade matching code I have no reason to believe it will not.
>>
>> At the very least this could be used to influence market conditions if it is only a display bug.
>>
>> --
>> Douglas Huff
>>
>>
>
> --
> Doug Huff
>
>
>
> ------------------------------------------------------------------------------
> All of the data generated in your IT infrastructure is seriously valuable.
> Why? It contains a definitive record of application performance, security
> threats, fraudulent activity, and more. Splunk takes this data and makes
> sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-d2d-c2
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>
>