📅 Original date posted:2011-06-28
🗒️ Summary of this message: Doug Huff reported a live trade matching bug on mtgox.com to the Bitcoin Development mailing list, which was deemed irrelevant to core Bitcoin development.
📝 Original message:Begin forwarded message:
> From: Doug Huff <dhuff at jrbobdobbs.org>
> Date: June 27, 2011 11:28:28 PM CDT
> To: Gavin Andresen <gavinandresen at gmail.com>
> Subject: Re: [Bitcoin-development] Fwd: Live mtgox.com trade matching bug.
>
> Already talked to Jeff and agreed to stop posting them here. There is just currently no other forum for such reports. I think he was going to talk to you about starting a bitcoin-vendor-sec or similar list.
>
> I agree it does not belong there.
>
> On Jun 27, 2011, at 11:22 PM, Gavin Andresen wrote:
>
>> The bitcoin-development list is for discussion of core bitcoin
>> development, not about Mt.Gox or other sites or software that uses
>> bitcoin.
>>
>> --
>> --
>> Gavin Andresen
>
> --
> Doug Huff
>
>
--
Doug Huff
On Jun 28, 2011, at 1:35 AM, Mike Hearn wrote:
> Hi Doug,
>
> Could we keep the Mt Gox related stuff off bitcoin-development please?
> It's not related to the core software.
>
> On Tue, Jun 28, 2011 at 4:48 AM, Doug Huff <dhuff at jrbobdobbs.org> wrote:
>>
>>
>> Begin forwarded message:
>>
>>> From: Doug Huff <mith at jrbobdobbs.org>
>>> Date: June 27, 2011 9:46:13 PM CDT
>>> To: full-disclosure at lists.grok.org.uk, "Mt.Gox" <info at mtgox.com>
>>> Cc: Bitcoin Dev Development <bitcoin-development at lists.sourceforge.net>
>>> Subject: Live mtgox.com trade matching bug.
>>>
>>> Step 1: Have USD available for spending on mtgox.com.
>>> Step 2: Put in a buy order large enough to drain your account. Low enough under the current trading price that it will not execute immediately.
>>> Step 3: Withdraw all USD funds.
>>> Step 4: Wait for market to fall enough to meet your order.
>>> Step 5: ...(self explanatory)...
>>>
>>> There's a bit of luck in being able to take advantage, obviously.
>>>
>>> I would suggest you take the site down asap until this is corrected or publicly show how this order will never execute:
>>>
>>> ==========
>>> Welcome <username removed> 0.00000000 ฿TC 424.44901
>>> Buying 138468.901 0.01 Active 1384.69 06/26 15:27 cancel
>>> ==========
>>>
>>> I cannot guarantee this order will execute but from everything I've observed about the new trade matching code I have no reason to believe it will not.
>>>
>>> At the very least this could be used to influence market conditions if it is only a display bug.
>>>
>>> --
>>> Douglas Huff
>>>
>>>
>>
>> --
>> Doug Huff
>>
>>
>>
>> ------------------------------------------------------------------------------
>> All of the data generated in your IT infrastructure is seriously valuable.
>> Why? It contains a definitive record of application performance, security
>> threats, fraudulent activity, and more. Splunk takes this data and makes
>> sense of it. IT sense. And common sense.
>> http://p.sf.net/sfu/splunk-d2d-c2
>> _______________________________________________
>> Bitcoin-development mailing list
>> Bitcoin-development at lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>>
>>
--
Doug Huff
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3737 bytes
Desc: not available
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110628/1d39d1a3/attachment.p7s>;
Doug Huff [ARCHIVE] /
npub1u2…h63q3
2023-06-07 01:23:44
in reply to nevent1q…e4k6
Author Public Key
npub1u2s36t2ty2ska7aswtr6kewwla57z978cdjzqpcl8zc3naadx66sah63q3Published at
2023-06-07 01:23:44Event JSON
{
"id": "eed6c8f87c584bced35f7605b96f3cb750eab4f9e5494e77d0a6285702d4630e",
"pubkey": "e2a11d2d4b22a16efbb072c7ab65ceff69e117c7c36420071f38b119f7ad36b5",
"created_at": 1686101024,
"kind": 1,
"tags": [
[
"e",
"301e85a8db67c135933d30d326ec3f0410781ae9a9ea3f2eaab96e87862e68ce",
"",
"root"
],
[
"e",
"5cf242cd3490dbf70ab9b2302c15e6d80341670ed538a1897895d4bcd2397eeb",
"",
"reply"
],
[
"p",
"cd753aa8fbc112e14ffe9fe09d3630f0eff76ca68e376e004b8e77b687adddba"
]
],
"content": "📅 Original date posted:2011-06-28\n🗒️ Summary of this message: Doug Huff reported a live trade matching bug on mtgox.com to the Bitcoin Development mailing list, which was deemed irrelevant to core Bitcoin development.\n📝 Original message:Begin forwarded message:\n\n\u003e From: Doug Huff \u003cdhuff at jrbobdobbs.org\u003e\n\u003e Date: June 27, 2011 11:28:28 PM CDT\n\u003e To: Gavin Andresen \u003cgavinandresen at gmail.com\u003e\n\u003e Subject: Re: [Bitcoin-development] Fwd: Live mtgox.com trade matching bug.\n\u003e \n\u003e Already talked to Jeff and agreed to stop posting them here. There is just currently no other forum for such reports. I think he was going to talk to you about starting a bitcoin-vendor-sec or similar list.\n\u003e \n\u003e I agree it does not belong there.\n\u003e \n\u003e On Jun 27, 2011, at 11:22 PM, Gavin Andresen wrote:\n\u003e \n\u003e\u003e The bitcoin-development list is for discussion of core bitcoin\n\u003e\u003e development, not about Mt.Gox or other sites or software that uses\n\u003e\u003e bitcoin.\n\u003e\u003e \n\u003e\u003e -- \n\u003e\u003e --\n\u003e\u003e Gavin Andresen\n\u003e \n\u003e -- \n\u003e Doug Huff\n\u003e \n\u003e \n\n-- \nDoug Huff\n\nOn Jun 28, 2011, at 1:35 AM, Mike Hearn wrote:\n\n\u003e Hi Doug,\n\u003e \n\u003e Could we keep the Mt Gox related stuff off bitcoin-development please?\n\u003e It's not related to the core software.\n\u003e \n\u003e On Tue, Jun 28, 2011 at 4:48 AM, Doug Huff \u003cdhuff at jrbobdobbs.org\u003e wrote:\n\u003e\u003e \n\u003e\u003e \n\u003e\u003e Begin forwarded message:\n\u003e\u003e \n\u003e\u003e\u003e From: Doug Huff \u003cmith at jrbobdobbs.org\u003e\n\u003e\u003e\u003e Date: June 27, 2011 9:46:13 PM CDT\n\u003e\u003e\u003e To: full-disclosure at lists.grok.org.uk, \"Mt.Gox\" \u003cinfo at mtgox.com\u003e\n\u003e\u003e\u003e Cc: Bitcoin Dev Development \u003cbitcoin-development at lists.sourceforge.net\u003e\n\u003e\u003e\u003e Subject: Live mtgox.com trade matching bug.\n\u003e\u003e\u003e \n\u003e\u003e\u003e Step 1: Have USD available for spending on mtgox.com.\n\u003e\u003e\u003e Step 2: Put in a buy order large enough to drain your account. Low enough under the current trading price that it will not execute immediately.\n\u003e\u003e\u003e Step 3: Withdraw all USD funds.\n\u003e\u003e\u003e Step 4: Wait for market to fall enough to meet your order.\n\u003e\u003e\u003e Step 5: ...(self explanatory)...\n\u003e\u003e\u003e \n\u003e\u003e\u003e There's a bit of luck in being able to take advantage, obviously.\n\u003e\u003e\u003e \n\u003e\u003e\u003e I would suggest you take the site down asap until this is corrected or publicly show how this order will never execute:\n\u003e\u003e\u003e \n\u003e\u003e\u003e ==========\n\u003e\u003e\u003e Welcome \u003cusername removed\u003e 0.00000000 ฿TC 424.44901\n\u003e\u003e\u003e Buying 138468.901 0.01 Active 1384.69 06/26 15:27 cancel\n\u003e\u003e\u003e ==========\n\u003e\u003e\u003e \n\u003e\u003e\u003e I cannot guarantee this order will execute but from everything I've observed about the new trade matching code I have no reason to believe it will not.\n\u003e\u003e\u003e \n\u003e\u003e\u003e At the very least this could be used to influence market conditions if it is only a display bug.\n\u003e\u003e\u003e \n\u003e\u003e\u003e --\n\u003e\u003e\u003e Douglas Huff\n\u003e\u003e\u003e \n\u003e\u003e\u003e \n\u003e\u003e \n\u003e\u003e --\n\u003e\u003e Doug Huff\n\u003e\u003e \n\u003e\u003e \n\u003e\u003e \n\u003e\u003e ------------------------------------------------------------------------------\n\u003e\u003e All of the data generated in your IT infrastructure is seriously valuable.\n\u003e\u003e Why? It contains a definitive record of application performance, security\n\u003e\u003e threats, fraudulent activity, and more. Splunk takes this data and makes\n\u003e\u003e sense of it. IT sense. And common sense.\n\u003e\u003e http://p.sf.net/sfu/splunk-d2d-c2\n\u003e\u003e _______________________________________________\n\u003e\u003e Bitcoin-development mailing list\n\u003e\u003e Bitcoin-development at lists.sourceforge.net\n\u003e\u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development\n\u003e\u003e \n\u003e\u003e \n\n-- \nDoug Huff\n\n\n-------------- next part --------------\nA non-text attachment was scrubbed...\nName: smime.p7s\nType: application/pkcs7-signature\nSize: 3737 bytes\nDesc: not available\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110628/1d39d1a3/attachment.p7s\u003e",
"sig": "b9fe06dee44f542489f97e3c9fb241e5f00c34a5b16a64ae757e6e6fedabc4b9efb0dc8950d3674062da62ebd735c138e62a04bab108f298052ec69364ab8b7e"
}