4 ms·

So this would require an attacker to pay into the exchange with BTCg, have the deposit clear and approve for trading, trade it for another currency, and have th

by zaroth 8y ago

So this would require an attacker to pay into the exchange with BTCg, have the deposit clear and approve for trading, trade it for another currency, and have that trade settle and be clear for withdrawal, and then process the withdrawal, all in under 4 hours. After which point the attacking miner surfaces a longer chain they had been keeping which doesn’t include the original BTCg deposit. Alternatively, if the exchange isn’t smart enough to pay short-term withdrawals with inputs that link back to the recent deposit, an attacker could just deposit and then withdraw with no trade and the withdraw transaction is valid even if the deposit is double-spent. An exchange that lets a trader deposit millions in one crypto-asset, exchange it for another, and clear a withdrawl in 4 hours... got what was coming to them? Where’s the KYC process for a million-dollar deposit? There’s a reason new deposits in a brokerage account take a few days to settle / be cleared for trading. And again after selling before funds can be withdrawn. And that’s a currency where most transactions can be reversed! It would be one thing to allow 10 block settlement for Bitcoin main-net. It’s another to allow it with a thinly mined alt-coin.

josu 8y ago
Many people use exchanges for arbitrage. Exchanges benefit from arbitrage since they take a fee out of every trade and because they want their prices to be close to the international price of the asset. This trade would look exactly the same as an arbitrage move.
- zaroth 8y ago
  I still maintain that letting the assets come in and leave on a different blockchain within 24 hours is akin to a “RTFM” level mistake. If exchanges are enticing arbitrage through insanely quick setttlement and clearance times on the order of 2 hours after closing a position, they are just playing with fire. If there wasn’t an actual trade, just transfering in and out, not chaining the transactions is similarly RTFM. If the facts are as I understand them, I think the exchange bears a significant portion of the blame. It’s like the story a couple weeks ago where Deutche Bank accidentally approved a wire transfer for $35 billion dollars.
  - josu 8y ago
    Exchanges are definitely playing with fire. Most crypto exchanges have probably more attack vectors than employees. Mitigating them is usually a tradeoff between security and UX. The most trustworthy exchanges don't even list shitcoins like Bitcoin Gold.
Jommi 8y ago
You're hitting the nail on the head on this one. Couldn't have said it myself. Majority of current exchanges are playing it absolutely fast-and dangerous. It's no surprise with new exchanges popping up like mushrooms. I'd bet that the top exchanges didn't lose anything on this. I'd actually wager this didn't happen to an exchange, but some other type of site, like a BTG Betting site or something.
dantillberg 8y ago
Exchanges need to be built with the fluid nature of blockchain conflict resolution in mind. You can estimate the cost of double-spend attacks on each chain at any time, calculate your potential exposure, track where the related funds are now in your system, and mitigate your exposure by delaying the outflow of funds that have outsize exposure to double-spend attack potential. In the simple case, you might allow withdrawal of a single $10 deposit after 2 confirmations but enforce a long 1000-confirmation waiting period on a million-dollar deposit, in order to increase the cost of executing a double-spend against your exchange beyond the point which you estimate it becomes infeasible. It's a little trickier in practice because someone could split their million-dollar deposit into 1000 thousand-dollar deposits from separate addresses into separate accounts. But you can still track your exposure in aggregate, and you should design a system to hold all impacted funds as long as is necessary to make a double-spend attack infeasible. You can be upfront with your clients about what's happening and why their withdrawals are sometimes delayed: it would increase confidence in the safety of honest customers' deposits while discouraging thieves from targeting you.
- gruez 8y ago
  >But you can still track your exposure in aggregate, and you should design a system to hold all impacted funds as long as is necessary to make a double-spend attack infeasible. also, you can monitor the value of transactions in the last few blocks. 500% spike in transaction value in the last 2 blocks? better add a few more blocks to the confirmation requirement, or require withholding on those deposits.

by zaroth 8y ago

josu 8y ago

Many people use exchanges for arbitrage. Exchanges benefit from arbitrage since they take a fee out of every trade and because they want their prices to be close to the international price of the asset. This trade would look exactly the same as an arbitrage move.

zaroth 8y ago
I still maintain that letting the assets come in and leave on a different blockchain within 24 hours is akin to a “RTFM” level mistake. If exchanges are enticing arbitrage through insanely quick setttlement and clearance times on the order of 2 hours after closing a position, they are just playing with fire. If there wasn’t an actual trade, just transfering in and out, not chaining the transactions is similarly RTFM. If the facts are as I understand them, I think the exchange bears a significant portion of the blame. It’s like the story a couple weeks ago where Deutche Bank accidentally approved a wire transfer for $35 billion dollars.
- josu 8y ago
  Exchanges are definitely playing with fire. Most crypto exchanges have probably more attack vectors than employees. Mitigating them is usually a tradeoff between security and UX. The most trustworthy exchanges don't even list shitcoins like Bitcoin Gold.

Jommi 8y ago

You're hitting the nail on the head on this one. Couldn't have said it myself. Majority of current exchanges are playing it absolutely fast-and dangerous. It's no surprise with new exchanges popping up like mushrooms. I'd bet that the top exchanges didn't lose anything on this. I'd actually wager this didn't happen to an exchange, but some other type of site, like a BTG Betting site or something.

dantillberg 8y ago

Exchanges need to be built with the fluid nature of blockchain conflict resolution in mind. You can estimate the cost of double-spend attacks on each chain at any time, calculate your potential exposure, track where the related funds are now in your system, and mitigate your exposure by delaying the outflow of funds that have outsize exposure to double-spend attack potential. In the simple case, you might allow withdrawal of a single $10 deposit after 2 confirmations but enforce a long 1000-confirmation waiting period on a million-dollar deposit, in order to increase the cost of executing a double-spend against your exchange beyond the point which you estimate it becomes infeasible. It's a little trickier in practice because someone could split their million-dollar deposit into 1000 thousand-dollar deposits from separate addresses into separate accounts. But you can still track your exposure in aggregate, and you should design a system to hold all impacted funds as long as is necessary to make a double-spend attack infeasible. You can be upfront with your clients about what's happening and why their withdrawals are sometimes delayed: it would increase confidence in the safety of honest customers' deposits while discouraging thieves from targeting you.

gruez 8y ago
>But you can still track your exposure in aggregate, and you should design a system to hold all impacted funds as long as is necessary to make a double-spend attack infeasible. also, you can monitor the value of transactions in the last few blocks. 500% spike in transaction value in the last 2 blocks? better add a few more blocks to the confirmation requirement, or require withholding on those deposits.