📅 Original date posted:2011-06-27
🗒️ Summary of this message: A bug in the trade matching code of mtgox.com allows users to withdraw all USD funds after placing a buy order that will drain their account.
📝 Original message:Begin forwarded message:
> From: Doug Huff <mith at jrbobdobbs.org>
> Date: June 27, 2011 9:46:13 PM CDT
> To: full-disclosure at lists.grok.org.uk, "Mt.Gox" <info at mtgox.com>
> Cc: Bitcoin Dev Development <bitcoin-development at lists.sourceforge.net>
> Subject: Live mtgox.com trade matching bug.
>
> Step 1: Have USD available for spending on mtgox.com.
> Step 2: Put in a buy order large enough to drain your account. Low enough under the current trading price that it will not execute immediately.
> Step 3: Withdraw all USD funds.
> Step 4: Wait for market to fall enough to meet your order.
> Step 5: ...(self explanatory)...
>
> There's a bit of luck in being able to take advantage, obviously.
>
> I would suggest you take the site down asap until this is corrected or publicly show how this order will never execute:
>
> ==========
> Welcome <username removed> 0.00000000 ฿TC 424.44901
> Buying 138468.901 0.01 Active 1384.69 06/26 15:27 cancel
> ==========
>
> I cannot guarantee this order will execute but from everything I've observed about the new trade matching code I have no reason to believe it will not.
>
> At the very least this could be used to influence market conditions if it is only a display bug.
>
> --
> Douglas Huff
>
>
--
Doug Huff
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3737 bytes
Desc: not available
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110627/d3cb2cbe/attachment.p7s>;
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 881 bytes
Desc: This is a digitally signed message part
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110627/d3cb2cbe/attachment.sig>;
Doug Huff [ARCHIVE] /
npub1u2…h63q3
2023-06-07 01:23:28
in reply to nevent1q…3g3l
Author Public Key
npub1u2s36t2ty2ska7aswtr6kewwla57z978cdjzqpcl8zc3naadx66sah63q3Published at
2023-06-07 01:23:28Event JSON
{
"id": "de12381ddef3fbcf2d79df1c3dd8fb385ae0153207f60cc7df0f8cc9065ac9ef",
"pubkey": "e2a11d2d4b22a16efbb072c7ab65ceff69e117c7c36420071f38b119f7ad36b5",
"created_at": 1686101008,
"kind": 1,
"tags": [
[
"e",
"301e85a8db67c135933d30d326ec3f0410781ae9a9ea3f2eaab96e87862e68ce",
"",
"reply"
],
[
"p",
"857b83d2624bdaeb3fa001fda56aa163e974359f543a471b9881d6660ad2bf98"
]
],
"content": "📅 Original date posted:2011-06-27\n🗒️ Summary of this message: A bug in the trade matching code of mtgox.com allows users to withdraw all USD funds after placing a buy order that will drain their account.\n📝 Original message:Begin forwarded message:\n\n\u003e From: Doug Huff \u003cmith at jrbobdobbs.org\u003e\n\u003e Date: June 27, 2011 9:46:13 PM CDT\n\u003e To: full-disclosure at lists.grok.org.uk, \"Mt.Gox\" \u003cinfo at mtgox.com\u003e\n\u003e Cc: Bitcoin Dev Development \u003cbitcoin-development at lists.sourceforge.net\u003e\n\u003e Subject: Live mtgox.com trade matching bug.\n\u003e \n\u003e Step 1: Have USD available for spending on mtgox.com.\n\u003e Step 2: Put in a buy order large enough to drain your account. Low enough under the current trading price that it will not execute immediately.\n\u003e Step 3: Withdraw all USD funds.\n\u003e Step 4: Wait for market to fall enough to meet your order.\n\u003e Step 5: ...(self explanatory)...\n\u003e \n\u003e There's a bit of luck in being able to take advantage, obviously.\n\u003e \n\u003e I would suggest you take the site down asap until this is corrected or publicly show how this order will never execute:\n\u003e \n\u003e ==========\n\u003e Welcome \u003cusername removed\u003e 0.00000000 ฿TC 424.44901\n\u003e Buying 138468.901 0.01 Active 1384.69 06/26 15:27 cancel\n\u003e ==========\n\u003e \n\u003e I cannot guarantee this order will execute but from everything I've observed about the new trade matching code I have no reason to believe it will not.\n\u003e \n\u003e At the very least this could be used to influence market conditions if it is only a display bug.\n\u003e \n\u003e -- \n\u003e Douglas Huff\n\u003e \n\u003e \n\n-- \nDoug Huff\n\n\n-------------- next part --------------\nA non-text attachment was scrubbed...\nName: smime.p7s\nType: application/pkcs7-signature\nSize: 3737 bytes\nDesc: not available\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110627/d3cb2cbe/attachment.p7s\u003e\n-------------- next part --------------\nA non-text attachment was scrubbed...\nName: PGP.sig\nType: application/pgp-signature\nSize: 881 bytes\nDesc: This is a digitally signed message part\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110627/d3cb2cbe/attachment.sig\u003e",
"sig": "1ed7cdf514bc37afcc63200d5a77dcd07d4433e8d18768f5cc5c3dc0b6e3cbc8d65605cb29ea8b15c9f42055bf93a0ae8807524b9f845af04212fac0eb65d875"
}