3 ms·

No, the bug was in the withdrawal code. Concurrency bug, numerous simultaneous withdrawals have a high change of succeeding and you are able to withdraw more th

• Scoundreller 4y ago
  Sure, but if silk road waited for X confirmations, it would have made it at least a bit more complex to pull off. (Maybe you could have just hammered it continuously, but hopefully would have to predict when the blocks would be confirmed. They’re not exactly every 10 minutes). It’s not exactly related to this hack, but poor blockchain practice on the part of silk road if it permitted withdraws this quick after deposits.
  • ufo 4y ago
    From what they said it sounds like the issue was executing the same withdrawal request more than once, unrelated to the bitcoin confirmation window. The fraudulent withdrawals had to happen on the same second, not merely on the same hour.
    • Scoundreller 4y ago
      That’s correct. I read the indictment and the first one was done within 5 seconds of deposit, while the next successful one was after 24 minutes.
  • theptip 4y ago
    If the bug is a read-modify-write sequence without a transaction, then regardless of whether you wait for more confirmations, the withdrawal action will always be racy and vulnerable to this exploit. Not waiting for confirmations would leave you vulnerable to random chain forks and make 51% attacks cheaper.
• deleted 4y ago
  [deleted]
• nmjohn 4y ago
  > Very common in amateur coded websites. Also common in professionally coded websites.
  • Scoundreller 4y ago
    « Do not click PAY more than once »