Topic: [ANN] Bisq - Exchange, Decentralized. - page 6. (Read 2543 times)

Didn’t know bitcointalk haven’t had a thread about bisq. So thank you so much for opening this one.
I haven't used it for a long time. But I can remember that the number of direct trades for Fiat (Sepa) <-> BTC was very small. Is it still like that?

One more release for you today.

v1.3.1 fixes a bug that marks valid trades as failed trades, and it also improves delayed deposit transaction verification.

To prevent further issues, we're requiring everyone to update to v1.3.1 to continue trading.

https://github.com/bisq-network/bisq/releases/tag/v1.3.1

Posted by Steve Jain on 8 April 2020

About 24 hours ago, we discovered that an attacker was able to exploit a flaw in the Bisq trade protocol, targeting individual trades in order to steal trading capital. We are aware of approximately 3 BTC and 4000 XMR stolen from 7 different victims. This is the situation as we know it so far. The only market affected was the XMR/BTC market, and all affected trades occured over the past 12 days.

Bisq v1.2, released in late October 2019, updated its trade protocol. It improved decentralization by removing arbitrators with a 3rd key in the multisig escrow used for bitcoin trading funds. These arbitrators were replaced with 2 new roles: mediators and arbitrators with no keys in the multisig escrow. With no more trusted third parties, the new trade protocol also required that trade parties move bitcoin trade funds to a Bisq “donation address” after a hard time limit in order to solve dead-locked trades.

This donation address is set by the Bisq DAO and approved by DAO stakeholders. Bisq software did not verify that the payout address for trades was actually the Bisq donation address set by the DAO before signing and sending the time-locked payout TX to the trade counterparty. In plain words, this exploit was the result of a flaw in the way Bisq trades are carried out, not in the way funds are stored (i.e., there is no honeypot since Bisq is P2P).

As soon as this attack was discovered, Bisq developers used the alert key to disable all trading on Bisq. The flaw in the trade protocol has been corrected in Bisq v1.3.0, now released. Bisq is properly peer-to-peer, so alert key functionality can be bypassed by users, but this is highly discouraged.

A proposal will soon be created in the Bisq DAO, Bisq’s funding mechanism, that will aim to repay the 7 victims from future trading revenues.

Security has always been a top priority for Bisq, but this incident shows it wasn’t perfect. The project is evaluating several approaches to strengthening security reviews and practices even more, and will detail them soon.

In the past 4 years of operating on mainnet, Bisq has never had to use the alert key to enable “safe mode” on Bisq nodes, and this is an unprecedented case for the Bisq DAO. The Bisq developer community sincerely apologizes for this security failure.

hi, If bisq is decentralized, so is it possible to add a token like on ForkDelta? Or does it require some registration or confirmation as on IDEX?

Hi layer1gfx, thanks for the answer. I searched through the forums but didn't find anything relating to it, I should probably join the forum & ask. Keybase won't load for me, probably due to my security settings, but I'd rather not lower them so will try the forum as I said.

Thanks anyway.

hi, i am not 100% if you can do that but it sounds not too much of an unusual thing someone might want to try.
i suggest to maybe search the Bisq forum or join the keybase channel to ask more questions, as mentioned above on keybase is a #support sub-channel where some volunteers could answer your questions. when i had more specific questions or problems it was always the best place to go and ask.

Does anyone know if it's possible to start the client specifying a different location for the user data?  I'd like to use a different location than the standard C:\Users\\AppData\Roaming\Bisq in windoze.

Thanks.

Ok but despite the exchange is said to be decentralized, i dont feel quite easy with the part of trading with another person which may somehow have my bank information or that not how it works?

hi, not sure what country are you from?

you can first check on the Bisq website if your fiat currency is supported:
https://bisq.network/markets/

in general, you can sell your crypto for fiat, another person on Bisq is buying from you and pays for it into your bank account, and after the money arrived you send the bitcoins.
it all depends on your bank and your country/fiat currency. many countries and banks or payment services are supported. so you may be able to receive payments.

Read that this decentralized exchange supported national fiat currencies. Could you provide me the list and does the exchange support bank transfer (i mean if i sell my crypto for fiat on there will i be able to withdraw the fiat into my bank account)?

Deal alert, USD buyers.

0.0623 BTC up for sale at 0% spread.

That's 6,230,000 sats for $352.

via US Postal Money Order:
- no account signing required
- no bank suspicion risk
- no chargeback risk

If you haven't tried USPS money orders yet, they're a breath of fresh air.

FYI, USPS money order is actually the 2nd-most common form of payment on Bisq for USD

fyi -- there was an issue with bitcoin node detection in today's v1.2.8 release,
so we've recalled v1.2.8 and will release v1.2.9 soon to fix.

if you're not having any issues with v1.2.8, feel free to carry on using it.