📅 Original date posted:2011-06-28
🗒️ Summary of this message: A bug in Mt Gox's trade matching code allowed users to withdraw USD funds after placing a buy order that would drain their account.
📝 Original message:Hi Doug,
Could we keep the Mt Gox related stuff off bitcoin-development please?
It's not related to the core software.
On Tue, Jun 28, 2011 at 4:48 AM, Doug Huff <dhuff at jrbobdobbs.org> wrote:
>
>
> Begin forwarded message:
>
>> From: Doug Huff <mith at jrbobdobbs.org>
>> Date: June 27, 2011 9:46:13 PM CDT
>> To: full-disclosure at lists.grok.org.uk, "Mt.Gox" <info at mtgox.com>
>> Cc: Bitcoin Dev Development <bitcoin-development at lists.sourceforge.net>
>> Subject: Live mtgox.com trade matching bug.
>>
>> Step 1: Have USD available for spending on mtgox.com.
>> Step 2: Put in a buy order large enough to drain your account. Low enough under the current trading price that it will not execute immediately.
>> Step 3: Withdraw all USD funds.
>> Step 4: Wait for market to fall enough to meet your order.
>> Step 5: ...(self explanatory)...
>>
>> There's a bit of luck in being able to take advantage, obviously.
>>
>> I would suggest you take the site down asap until this is corrected or publicly show how this order will never execute:
>>
>> ==========
>> Welcome <username removed> 0.00000000 ฿TC 424.44901
>> Buying 138468.901 0.01 Active 1384.69 06/26 15:27 cancel
>> ==========
>>
>> I cannot guarantee this order will execute but from everything I've observed about the new trade matching code I have no reason to believe it will not.
>>
>> At the very least this could be used to influence market conditions if it is only a display bug.
>>
>> --
>> Douglas Huff
>>
>>
>
> --
> Doug Huff
>
>
>
> ------------------------------------------------------------------------------
> All of the data generated in your IT infrastructure is seriously valuable.
> Why? It contains a definitive record of application performance, security
> threats, fraudulent activity, and more. Splunk takes this data and makes
> sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-d2d-c2
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>
>
Mike Hearn [ARCHIVE] /
npub17t…4qgyd
2023-06-07 01:58:46
in reply to nevent1q…rrqf
Author Public Key
npub17ty4mumkv43w8wtt0xsz2jypck0gvw0j8xrcg6tpea25z2nh7meqf4qgydPublished at
2023-06-07 01:58:46Event JSON
{
"id": "ea0c610fcc33d2135d0120bc8aa3804d553d34a5d2a4028e19c1224bc95c033f",
"pubkey": "f2c95df3766562e3b96b79a0254881c59e8639f23987846961cf55412a77f6f2",
"created_at": 1686103126,
"kind": 1,
"tags": [
[
"e",
"db5fefe2adcfbfc090f6cdd6db185557ce4fc7a9697a48b7b46281bd6489156f",
"",
"root"
],
[
"e",
"ab5082a7d24d91eabcb565db4b221910e7d72f7f5ae69b80be7a484564525c4d",
"",
"reply"
],
[
"p",
"e2a11d2d4b22a16efbb072c7ab65ceff69e117c7c36420071f38b119f7ad36b5"
]
],
"content": "📅 Original date posted:2011-06-28\n🗒️ Summary of this message: A bug in Mt Gox's trade matching code allowed users to withdraw USD funds after placing a buy order that would drain their account.\n📝 Original message:Hi Doug,\n\nCould we keep the Mt Gox related stuff off bitcoin-development please?\nIt's not related to the core software.\n\nOn Tue, Jun 28, 2011 at 4:48 AM, Doug Huff \u003cdhuff at jrbobdobbs.org\u003e wrote:\n\u003e\n\u003e\n\u003e Begin forwarded message:\n\u003e\n\u003e\u003e From: Doug Huff \u003cmith at jrbobdobbs.org\u003e\n\u003e\u003e Date: June 27, 2011 9:46:13 PM CDT\n\u003e\u003e To: full-disclosure at lists.grok.org.uk, \"Mt.Gox\" \u003cinfo at mtgox.com\u003e\n\u003e\u003e Cc: Bitcoin Dev Development \u003cbitcoin-development at lists.sourceforge.net\u003e\n\u003e\u003e Subject: Live mtgox.com trade matching bug.\n\u003e\u003e\n\u003e\u003e Step 1: Have USD available for spending on mtgox.com.\n\u003e\u003e Step 2: Put in a buy order large enough to drain your account. Low enough under the current trading price that it will not execute immediately.\n\u003e\u003e Step 3: Withdraw all USD funds.\n\u003e\u003e Step 4: Wait for market to fall enough to meet your order.\n\u003e\u003e Step 5: ...(self explanatory)...\n\u003e\u003e\n\u003e\u003e There's a bit of luck in being able to take advantage, obviously.\n\u003e\u003e\n\u003e\u003e I would suggest you take the site down asap until this is corrected or publicly show how this order will never execute:\n\u003e\u003e\n\u003e\u003e ==========\n\u003e\u003e Welcome \u003cusername removed\u003e 0.00000000 ฿TC 424.44901\n\u003e\u003e Buying 138468.901 0.01 Active 1384.69 06/26 15:27 cancel\n\u003e\u003e ==========\n\u003e\u003e\n\u003e\u003e I cannot guarantee this order will execute but from everything I've observed about the new trade matching code I have no reason to believe it will not.\n\u003e\u003e\n\u003e\u003e At the very least this could be used to influence market conditions if it is only a display bug.\n\u003e\u003e\n\u003e\u003e --\n\u003e\u003e Douglas Huff\n\u003e\u003e\n\u003e\u003e\n\u003e\n\u003e --\n\u003e Doug Huff\n\u003e\n\u003e\n\u003e\n\u003e ------------------------------------------------------------------------------\n\u003e All of the data generated in your IT infrastructure is seriously valuable.\n\u003e Why? It contains a definitive record of application performance, security\n\u003e threats, fraudulent activity, and more. Splunk takes this data and makes\n\u003e sense of it. IT sense. And common sense.\n\u003e http://p.sf.net/sfu/splunk-d2d-c2\n\u003e _______________________________________________\n\u003e Bitcoin-development mailing list\n\u003e Bitcoin-development at lists.sourceforge.net\n\u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development\n\u003e\n\u003e",
"sig": "21a5eb01dfe8a58344c81ae9edd2e509ebdf2253a351b32b2a2ef65853495628fd16c0c8729ffbddaef1169d9692c7bd26bd5f0dcfc1755f0ad061114f322777"
}