📅 Original date posted:2015-07-16
📝 Original message:Simon - tx hashes or it didn't happen
Kidding aside, would be great if you could share the confirmed and
double-spent hashes so the rest of us can dive in and learn from this.
On Thu, Jul 16, 2015 at 7:50 AM, Me via bitcoin-dev <
bitcoin-dev at lists.linuxfoundation.org> wrote:
> minrelaytxfee setting proposed in the 0.11.0 release notes
>
> my guess, he is talking about this
> https://bitcoin.org/en/glossary/minimum-relay-fee - slam dunk technique
> for doublespend
>
>
>
> Related: is there somewhere a chart that plots `estimatefee` over
> time? Would be interesting to see how the fee market evolved over
> these past weeks.
>
>
> I find this useful
> https://bitcoinfees.github.io/
>
>
>
>
>
> On Jul 16, 2015, at 7:30 AM, Arne Brutschy via bitcoin-dev <
> bitcoin-dev at lists.linuxfoundation.org> wrote:
>
> Hello,
>
> What are these pre- and post-Hearn-relay drop rules you are speaking
> about? Can anybody shed some light on this? (I am aware of the
> minrelaytxfee setting proposed in the 0.11.0 release notes, I just
> don't see what this has to do with Mike Hearn, BitcoinXT, and whether
> there's a code change related to this that I missed).
>
> Related: is there somewhere a chart that plots `estimatefee` over
> time? Would be interesting to see how the fee market evolved over
> these past weeks.
>
> Regards
> Arne
>
> On 15/07/15 05:29, simongreen--- via bitcoin-dev wrote:
>
> With my black hat on I recently performed numerous profitable
> double-spend attacks against zeroconf accepting fools. With my
> white hat on, I'm warning everyone. The strategy is simple:
>
> tx1: To merchant, but dust/low-fee/reused-address/large-size/etc.
> anything that miners don't always accept.
>
> tx2: After merchant gives up valuable thing in return, normal tx
> without triggering spam protections. (loltasticly a Mike Hearn
> Bitcoin XT node was used to relay the double-spends)
>
> Example success story: tx1 paying Shapeshift.io <http://shapeshift.io>;
> with 6uBTC output
> is not dust under post-Hearn-relay-drop rules, but is dust under
> pre-Hearn-relay-drop rules, followed by tx2 w/o the output and not
> paying Shapeshift.io <http://shapeshift.io>;.
> F2Pool/Eligius/BTCChina/AntPool etc. are all
> miners who have reverted Hearn's 10x relay fee drop as recommended
> by v0.11.0 release notes and accept these double-spends.
> Shapeshift.io <http://shapeshift.io>; lost ~3 BTC this week in multiple
> txs. (they're no
> longer accepting zeroconf)
>
> Example success story #2: tx1 with post-Hearn-relay drop fee,
> followed by tx2 with higher fee. Such stupidly low fee txs just
> don't get mined, so wait for a miner to mine tx2. Bought a silly
> amount of reddit gold off Coinbase this way among other things. I'm
> surprised that reddit didn't cancel the "fools-gold" after tx
> reversal. (did Coinbase guarantee those txs?) Also found multiple
> Bitcoin ATMs vulnerable to this attack. (but simulated attack with
> tx2s still paying ATM because didn't want to go to trouble of good
> phys opsec)
>
> Shoutouts to BitPay who did things right and notified merchant
> properly when tx was reversed.
>
> In summary, every target depending on zeroconf vulnerable and lost
> significant sums of money to totally trivial attacks with high
> probability. No need for RBF to do this, just normal variations in
> miner policy. Shapeshift claims to use Super Sophisticated Network
> Sybil Attacking Monitoring from Blockcypher, but relay nodes !=
> miner policy.
>
> Consider yourself warned! My hat is whiter than most, and my skills
> not particularly good.
>
> What to do? Users: Listen to the experts and stop relying on
> zeroconf. Black hats: Profit!
>
> _______________________________________________ bitcoin-dev mailing
> list bitcoin-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>
>
> --
> Arne Brutschy <abrutschy at xylon.de>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>
>
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20150716/127ff899/attachment-0001.html>;
Greg Schvey [ARCHIVE] /
npub1jr…lyyr9
2023-06-07 15:42:25
in reply to nevent1q…a3z9
Author Public Key
npub1jruj94q683r5wtk2lmg4yteae3vzuh3pk7n9egwgl0wp7dypdzcqklyyr9Published at
2023-06-07 15:42:25Event JSON
{
"id": "0268012793ea4a70e87e2202ed302bd2dd88c0e300ff3a635cfe58691ebee945",
"pubkey": "90f922d41a3c47472ecafed1522f3dcc582e5e21b7a65ca1c8fbdc1f348168b0",
"created_at": 1686152545,
"kind": 1,
"tags": [
[
"e",
"8cfdb6ed676e52875cd3360f4e3b9fd8a9125080a56694ae91a3defb5a52e9fc",
"",
"root"
],
[
"e",
"0fd0cc3af750476ba0c00490f3ca0b1c3a6ccdfbd7586ad7ed284f2a8e10bb76",
"",
"reply"
],
[
"p",
"674837a61b71bdeceed4c8bd63a7b0bcc093eed02ec2beee7acd69965f15700d"
]
],
"content": "📅 Original date posted:2015-07-16\n📝 Original message:Simon - tx hashes or it didn't happen\n\nKidding aside, would be great if you could share the confirmed and\ndouble-spent hashes so the rest of us can dive in and learn from this.\n\nOn Thu, Jul 16, 2015 at 7:50 AM, Me via bitcoin-dev \u003c\nbitcoin-dev at lists.linuxfoundation.org\u003e wrote:\n\n\u003e minrelaytxfee setting proposed in the 0.11.0 release notes\n\u003e\n\u003e my guess, he is talking about this\n\u003e https://bitcoin.org/en/glossary/minimum-relay-fee - slam dunk technique\n\u003e for doublespend\n\u003e\n\u003e\n\u003e\n\u003e Related: is there somewhere a chart that plots `estimatefee` over\n\u003e time? Would be interesting to see how the fee market evolved over\n\u003e these past weeks.\n\u003e\n\u003e\n\u003e I find this useful\n\u003e https://bitcoinfees.github.io/\n\u003e\n\u003e\n\u003e\n\u003e\n\u003e\n\u003e On Jul 16, 2015, at 7:30 AM, Arne Brutschy via bitcoin-dev \u003c\n\u003e bitcoin-dev at lists.linuxfoundation.org\u003e wrote:\n\u003e\n\u003e Hello,\n\u003e\n\u003e What are these pre- and post-Hearn-relay drop rules you are speaking\n\u003e about? Can anybody shed some light on this? (I am aware of the\n\u003e minrelaytxfee setting proposed in the 0.11.0 release notes, I just\n\u003e don't see what this has to do with Mike Hearn, BitcoinXT, and whether\n\u003e there's a code change related to this that I missed).\n\u003e\n\u003e Related: is there somewhere a chart that plots `estimatefee` over\n\u003e time? Would be interesting to see how the fee market evolved over\n\u003e these past weeks.\n\u003e\n\u003e Regards\n\u003e Arne\n\u003e\n\u003e On 15/07/15 05:29, simongreen--- via bitcoin-dev wrote:\n\u003e\n\u003e With my black hat on I recently performed numerous profitable\n\u003e double-spend attacks against zeroconf accepting fools. With my\n\u003e white hat on, I'm warning everyone. The strategy is simple:\n\u003e\n\u003e tx1: To merchant, but dust/low-fee/reused-address/large-size/etc.\n\u003e anything that miners don't always accept.\n\u003e\n\u003e tx2: After merchant gives up valuable thing in return, normal tx\n\u003e without triggering spam protections. (loltasticly a Mike Hearn\n\u003e Bitcoin XT node was used to relay the double-spends)\n\u003e\n\u003e Example success story: tx1 paying Shapeshift.io \u003chttp://shapeshift.io\u003e\n\u003e with 6uBTC output\n\u003e is not dust under post-Hearn-relay-drop rules, but is dust under\n\u003e pre-Hearn-relay-drop rules, followed by tx2 w/o the output and not\n\u003e paying Shapeshift.io \u003chttp://shapeshift.io\u003e.\n\u003e F2Pool/Eligius/BTCChina/AntPool etc. are all\n\u003e miners who have reverted Hearn's 10x relay fee drop as recommended\n\u003e by v0.11.0 release notes and accept these double-spends.\n\u003e Shapeshift.io \u003chttp://shapeshift.io\u003e lost ~3 BTC this week in multiple\n\u003e txs. (they're no\n\u003e longer accepting zeroconf)\n\u003e\n\u003e Example success story #2: tx1 with post-Hearn-relay drop fee,\n\u003e followed by tx2 with higher fee. Such stupidly low fee txs just\n\u003e don't get mined, so wait for a miner to mine tx2. Bought a silly\n\u003e amount of reddit gold off Coinbase this way among other things. I'm\n\u003e surprised that reddit didn't cancel the \"fools-gold\" after tx\n\u003e reversal. (did Coinbase guarantee those txs?) Also found multiple\n\u003e Bitcoin ATMs vulnerable to this attack. (but simulated attack with\n\u003e tx2s still paying ATM because didn't want to go to trouble of good\n\u003e phys opsec)\n\u003e\n\u003e Shoutouts to BitPay who did things right and notified merchant\n\u003e properly when tx was reversed.\n\u003e\n\u003e In summary, every target depending on zeroconf vulnerable and lost\n\u003e significant sums of money to totally trivial attacks with high\n\u003e probability. No need for RBF to do this, just normal variations in\n\u003e miner policy. Shapeshift claims to use Super Sophisticated Network\n\u003e Sybil Attacking Monitoring from Blockcypher, but relay nodes !=\n\u003e miner policy.\n\u003e\n\u003e Consider yourself warned! My hat is whiter than most, and my skills\n\u003e not particularly good.\n\u003e\n\u003e What to do? Users: Listen to the experts and stop relying on\n\u003e zeroconf. Black hats: Profit!\n\u003e\n\u003e _______________________________________________ bitcoin-dev mailing\n\u003e list bitcoin-dev at lists.linuxfoundation.org\n\u003e https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev\n\u003e\n\u003e\n\u003e --\n\u003e Arne Brutschy \u003cabrutschy at xylon.de\u003e\n\u003e _______________________________________________\n\u003e bitcoin-dev mailing list\n\u003e bitcoin-dev at lists.linuxfoundation.org\n\u003e https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev\n\u003e\n\u003e\n\u003e\n\u003e _______________________________________________\n\u003e bitcoin-dev mailing list\n\u003e bitcoin-dev at lists.linuxfoundation.org\n\u003e https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev\n\u003e\n\u003e\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20150716/127ff899/attachment-0001.html\u003e",
"sig": "8365997f0d5f070b0b9edce607425f93c22d4954e2c2d56b885b20e110dfd6795c35cd938f3eab1675cacc830a654dd59dd671e43be526f21271ce9b3fe8ffdd"
}