* [Bitcoin-development] Fwd: Live mtgox.com trade matching bug. [not found] <D024B465-AD6C-4AAD-A07F-956223929B6F@jrbobdobbs.org> @ 2011-06-28 2:48 ` Doug Huff 2011-06-28 6:35 ` Mike Hearn 0 siblings, 1 reply; 6+ messages in thread From: Doug Huff @ 2011-06-28 2:48 UTC (permalink / raw) To: Bitcoin Dev Development [-- Attachment #1.1: Type: text/plain, Size: 1317 bytes --] Begin forwarded message: > From: Doug Huff <mith@jrbobdobbs•org> > Date: June 27, 2011 9:46:13 PM CDT > To: full-disclosure@lists•grok.org.uk, "Mt.Gox" <info@mtgox•com> > Cc: Bitcoin Dev Development <bitcoin-development@lists•sourceforge.net> > Subject: Live mtgox.com trade matching bug. > > Step 1: Have USD available for spending on mtgox.com. > Step 2: Put in a buy order large enough to drain your account. Low enough under the current trading price that it will not execute immediately. > Step 3: Withdraw all USD funds. > Step 4: Wait for market to fall enough to meet your order. > Step 5: ...(self explanatory)... > > There's a bit of luck in being able to take advantage, obviously. > > I would suggest you take the site down asap until this is corrected or publicly show how this order will never execute: > > ========== > Welcome <username removed> 0.00000000 ฿TC 424.44901 > Buying 138468.901 0.01 Active 1384.69 06/26 15:27 cancel > ========== > > I cannot guarantee this order will execute but from everything I've observed about the new trade matching code I have no reason to believe it will not. > > At the very least this could be used to influence market conditions if it is only a display bug. > > -- > Douglas Huff > > -- Doug Huff [-- Attachment #1.2: smime.p7s --] [-- Type: application/pkcs7-signature, Size: 3737 bytes --] [-- Attachment #2: This is a digitally signed message part --] [-- Type: application/pgp-signature, Size: 881 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Bitcoin-development] Fwd: Live mtgox.com trade matching bug. 2011-06-28 2:48 ` [Bitcoin-development] Fwd: Live mtgox.com trade matching bug Doug Huff @ 2011-06-28 6:35 ` Mike Hearn 2011-06-28 6:57 ` Luke-Jr 2011-06-28 13:24 ` Doug Huff 0 siblings, 2 replies; 6+ messages in thread From: Mike Hearn @ 2011-06-28 6:35 UTC (permalink / raw) To: Doug Huff; +Cc: Bitcoin Dev Development Hi Doug, Could we keep the Mt Gox related stuff off bitcoin-development please? It's not related to the core software. On Tue, Jun 28, 2011 at 4:48 AM, Doug Huff <dhuff@jrbobdobbs•org> wrote: > > > Begin forwarded message: > >> From: Doug Huff <mith@jrbobdobbs•org> >> Date: June 27, 2011 9:46:13 PM CDT >> To: full-disclosure@lists•grok.org.uk, "Mt.Gox" <info@mtgox•com> >> Cc: Bitcoin Dev Development <bitcoin-development@lists•sourceforge.net> >> Subject: Live mtgox.com trade matching bug. >> >> Step 1: Have USD available for spending on mtgox.com. >> Step 2: Put in a buy order large enough to drain your account. Low enough under the current trading price that it will not execute immediately. >> Step 3: Withdraw all USD funds. >> Step 4: Wait for market to fall enough to meet your order. >> Step 5: ...(self explanatory)... >> >> There's a bit of luck in being able to take advantage, obviously. >> >> I would suggest you take the site down asap until this is corrected or publicly show how this order will never execute: >> >> ========== >> Welcome <username removed> 0.00000000 ฿TC 424.44901 >> Buying 138468.901 0.01 Active 1384.69 06/26 15:27 cancel >> ========== >> >> I cannot guarantee this order will execute but from everything I've observed about the new trade matching code I have no reason to believe it will not. >> >> At the very least this could be used to influence market conditions if it is only a display bug. >> >> -- >> Douglas Huff >> >> > > -- > Doug Huff > > > > ------------------------------------------------------------------------------ > All of the data generated in your IT infrastructure is seriously valuable. > Why? It contains a definitive record of application performance, security > threats, fraudulent activity, and more. Splunk takes this data and makes > sense of it. IT sense. And common sense. > http://p.sf.net/sfu/splunk-d2d-c2 > _______________________________________________ > Bitcoin-development mailing list > Bitcoin-development@lists•sourceforge.net > https://lists.sourceforge.net/lists/listinfo/bitcoin-development > > ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Bitcoin-development] Fwd: Live mtgox.com trade matching bug. 2011-06-28 6:35 ` Mike Hearn @ 2011-06-28 6:57 ` Luke-Jr 2011-06-28 9:52 ` Mike Hearn 2011-06-28 13:24 ` Doug Huff 1 sibling, 1 reply; 6+ messages in thread From: Luke-Jr @ 2011-06-28 6:57 UTC (permalink / raw) To: bitcoin-development On Tuesday, June 28, 2011 2:35:59 AM Mike Hearn wrote: > Could we keep the Mt Gox related stuff off bitcoin-development please? > It's not related to the core software. MtGox's code is just as related as BitcoinJ or any other Bitcoin software, IMO. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Bitcoin-development] Fwd: Live mtgox.com trade matching bug. 2011-06-28 6:57 ` Luke-Jr @ 2011-06-28 9:52 ` Mike Hearn 2011-06-28 11:54 ` Matt Corallo 0 siblings, 1 reply; 6+ messages in thread From: Mike Hearn @ 2011-06-28 9:52 UTC (permalink / raw) To: Luke-Jr; +Cc: bitcoin-development >> Could we keep the Mt Gox related stuff off bitcoin-development please? >> It's not related to the core software. > > MtGox's code is just as related as BitcoinJ or any other Bitcoin software, > IMO. It's closed source, so nobody here can do anything about it (unlike other software discussed here). ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Bitcoin-development] Fwd: Live mtgox.com trade matching bug. 2011-06-28 9:52 ` Mike Hearn @ 2011-06-28 11:54 ` Matt Corallo 0 siblings, 0 replies; 6+ messages in thread From: Matt Corallo @ 2011-06-28 11:54 UTC (permalink / raw) To: bitcoin-development [-- Attachment #1: Type: text/plain, Size: 626 bytes --] On Tue, 2011-06-28 at 11:52 +0200, Mike Hearn wrote: > >> Could we keep the Mt Gox related stuff off bitcoin-development please? > >> It's not related to the core software. > > > > MtGox's code is just as related as BitcoinJ or any other Bitcoin software, > > IMO. > > It's closed source, so nobody here can do anything about it (unlike > other software discussed here). And this is also no where near the right place to be disclosing security vulnerabilities. Whether you like the guy/site or not, keep those prive for a reasonable amount of time for them to be fixed (that means more than an hour). Matt [-- Attachment #2: This is a digitally signed message part --] [-- Type: application/pgp-signature, Size: 836 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Bitcoin-development] Fwd: Live mtgox.com trade matching bug. 2011-06-28 6:35 ` Mike Hearn 2011-06-28 6:57 ` Luke-Jr @ 2011-06-28 13:24 ` Doug Huff 1 sibling, 0 replies; 6+ messages in thread From: Doug Huff @ 2011-06-28 13:24 UTC (permalink / raw) To: Mike Hearn; +Cc: Bitcoin Dev Development [-- Attachment #1: Type: text/plain, Size: 3098 bytes --] Begin forwarded message: > From: Doug Huff <dhuff@jrbobdobbs•org> > Date: June 27, 2011 11:28:28 PM CDT > To: Gavin Andresen <gavinandresen@gmail•com> > Subject: Re: [Bitcoin-development] Fwd: Live mtgox.com trade matching bug. > > Already talked to Jeff and agreed to stop posting them here. There is just currently no other forum for such reports. I think he was going to talk to you about starting a bitcoin-vendor-sec or similar list. > > I agree it does not belong there. > > On Jun 27, 2011, at 11:22 PM, Gavin Andresen wrote: > >> The bitcoin-development list is for discussion of core bitcoin >> development, not about Mt.Gox or other sites or software that uses >> bitcoin. >> >> -- >> -- >> Gavin Andresen > > -- > Doug Huff > > -- Doug Huff On Jun 28, 2011, at 1:35 AM, Mike Hearn wrote: > Hi Doug, > > Could we keep the Mt Gox related stuff off bitcoin-development please? > It's not related to the core software. > > On Tue, Jun 28, 2011 at 4:48 AM, Doug Huff <dhuff@jrbobdobbs•org> wrote: >> >> >> Begin forwarded message: >> >>> From: Doug Huff <mith@jrbobdobbs•org> >>> Date: June 27, 2011 9:46:13 PM CDT >>> To: full-disclosure@lists•grok.org.uk, "Mt.Gox" <info@mtgox•com> >>> Cc: Bitcoin Dev Development <bitcoin-development@lists•sourceforge.net> >>> Subject: Live mtgox.com trade matching bug. >>> >>> Step 1: Have USD available for spending on mtgox.com. >>> Step 2: Put in a buy order large enough to drain your account. Low enough under the current trading price that it will not execute immediately. >>> Step 3: Withdraw all USD funds. >>> Step 4: Wait for market to fall enough to meet your order. >>> Step 5: ...(self explanatory)... >>> >>> There's a bit of luck in being able to take advantage, obviously. >>> >>> I would suggest you take the site down asap until this is corrected or publicly show how this order will never execute: >>> >>> ========== >>> Welcome <username removed> 0.00000000 ฿TC 424.44901 >>> Buying 138468.901 0.01 Active 1384.69 06/26 15:27 cancel >>> ========== >>> >>> I cannot guarantee this order will execute but from everything I've observed about the new trade matching code I have no reason to believe it will not. >>> >>> At the very least this could be used to influence market conditions if it is only a display bug. >>> >>> -- >>> Douglas Huff >>> >>> >> >> -- >> Doug Huff >> >> >> >> ------------------------------------------------------------------------------ >> All of the data generated in your IT infrastructure is seriously valuable. >> Why? It contains a definitive record of application performance, security >> threats, fraudulent activity, and more. Splunk takes this data and makes >> sense of it. IT sense. And common sense. >> http://p.sf.net/sfu/splunk-d2d-c2 >> _______________________________________________ >> Bitcoin-development mailing list >> Bitcoin-development@lists•sourceforge.net >> https://lists.sourceforge.net/lists/listinfo/bitcoin-development >> >> -- Doug Huff [-- Attachment #2: smime.p7s --] [-- Type: application/pkcs7-signature, Size: 3737 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2011-06-28 13:24 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <D024B465-AD6C-4AAD-A07F-956223929B6F@jrbobdobbs.org>
2011-06-28 2:48 ` [Bitcoin-development] Fwd: Live mtgox.com trade matching bug Doug Huff
2011-06-28 6:35 ` Mike Hearn
2011-06-28 6:57 ` Luke-Jr
2011-06-28 9:52 ` Mike Hearn
2011-06-28 11:54 ` Matt Corallo
2011-06-28 13:24 ` Doug Huff
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox