Topic: eXch - instant exchange BTC / LN / XMR / LTC / ETH / ERC20 - page 51. (Read 27792 times)

@eXch.cc is it possible that some IP addresses are banned by eXch exchange or it could be something browser related?
Some people told me that they can't access eXch website with clearnet domain, and they receive message like this in Chrome browser:


It is all explained in Affiliation page.
You receive 30% profit, and you can enter your withdrawal address when you collect 0.001 BTC (or equivalent to 0.001 BTC in other currencies).
https://exch.cx/affiliation

I paid more attention to privacy than calculate the fee, because eXch already has low fee currencies such as monero and litecoin.
Like Monero, So far the fees offered between 0.1 - 0.05 USD. if it's that amount is quite expensive for your, there is Litecoin which might be set below than Monero.

About Affiliate program, how to divide it?. because when registering the exchange didn't ask bitcoin address to receive preofit.

I am personally not a big fan of that new tendency of graphic design used in some threads where one must scroll through large images full of visual distraction to find useful information, so I prefer text-only threads mostly. However, it's true that our OP here can be improved and icopress already provided us with a reasonable thread design that we will eventually update to after some editing.

The quote in OP you are referring to was the OP itself before our service relaunch.


The PM was already sent to theymos.

I was thinking if eXch would think to revamp this thread a bit.

For example, the way post #1 is written looks oldish... Maybe a new design for the main topic would look better and, maybe, it would catch also the attention of more users?

Besides, there is a quote in OP which I am not sure from where it is taken, as it does not appear on the website (or, at least, I did not see it).

---

Other than that, I also noticed this post:


My suggestion is to contact theymos about this issue, as there are infinitesimal chances for him to see this post inside this thread. Best approach is to send him a PM and explain the situation, then kindly ask to change your name. It does not happen very often but I witnessed a few such changes within last years, so there is hope.

Here is the answer you are looking for, from the representative

The exchanger is very easy to use, which is good, low fees, fast exchange. A letter of guarantee is also a positive point, which can eliminate all controversial issues.

Among the shortcomings, I would probably note the small number of supported networks. It would not be superfluous to have TRC20, it seems to me that USDT TRC20 is used by a much larger number of users than ERC20, for those who make frequent exchanges will pay attention to fees.

Thanks, I just know that method, but there have limit maximum which can be sent like the picture below.



I am not sure if the problem is litecoin, where maybe the exchange only have a few on the storage.

"Cloudflare free" usually means that a website doesn't use Cloudflare's reverse-proxy service to prevent exposure of their users to MITM and UX issues, however this is not related to Cloudflare's NS service used by our domain name.

The main role of nameservers (NS) is to serve DNS records, which in our case is the "A" record that points users to the IP address of our web-server when they lookup our domain name. We use Cloudflare's nameservers because they are reliable and fast due to their company's considerable infrastructure available across the globe. They also provide a Tor-friendly API which we use to manage our DNS records.

The only possible attack vector in this case is DNS record hijacking. It means that Cloudflare will have to change our domain's "A" record from our IP address to another one with a working reverse-proxy in order to intercept all the network traffic of our users (MITM). This attack is very unlikely to happen because there is no point to do this in our case, since anyone on the Internet will be able to detect a such event and also because we will receive an alert from our security monitoring system about a DNS record change and will simply switch our NS to somewhere else. It is also worth to mention that a fingerprint of the website's TLS certificate will change during a such attack, since there is no way they can retrieve the private key of our TLS certificate to use it on their MITM reverse-proxy. There is a browser extension called CheckMyHTTPS (https://github.com/checkmyhttps/checkmyhttps) that is useful to detect HTTPS fingerprint changes, however not as reliable as the older Certificate Patrol (https://github.com/tg-x/certpatrol) which was storing each website's certificate fingerprints locally to detect and alert about fingerprint changes later.

Such attacks are very rare to happen, but when they happen, they're usually some LE operations with enough gathered intelligence to know what to intercept that mostly go for website's operators (i.e. admin credentials) and not their users. Our management interface is not available via clearnet at all nor located at our public Tor HS either, therefore a DNS hijacking attack on our domain name would not bring anything useful to LE.

The most famous LE operations with this technique involved that come up to my mind were mostly targeting botnets, where they intercepted operators credentials that usually represent superior value for investigations in order to obtain ultimate evidence. Nevertheless, this technique is not popular anymore compared to cooperating directly with datacenter operators and upstream network providers. I recommend searching through KrebsOnSecurity blog for the "takedown" keyword to find relevant articles and to learn more about LE methodologies and strategies.

Well here is how i do it. I do enter the amount to calculate how many coins i will get, so i can get an idea of the exchange rate that i will get.

Now, before doing the actual exchange, I will clear all fields, and write only in the "To address" my address, keep the amount filed blank and click "Exchange". On the order process window, it will ask me to send any amount of the cryptocurrency to the given address.

Hey @eXch.cc, according to what's said on your website. Your service is Cloudflare free. Definitely one of your biggest selling points for someone who is in search of some level of privacy when exchanging their coins.

But then you use Cloudflare DNS according to whois. Now I am not too informed about how websites work, maybe I may learn a thing or two here. Can't a Domain Name Server be used by Cloudflare to gain access to your website's traffic there by compromising client's privacy?

Icopress invited me to review eXch if I have time to review it. It's been a week now and I think I should.

---

This is my review

I wanted to use exch service in the afternoon but the site was not working excellently. I wanted to exchange some coins, I inputted the amount and clicked on exchange. There was nothing but my browser keep on showing the process but no result. I tried again 30 minutes later and it was working perfectly, but I waited until nighttime because I was later busy in the afternoon. I tried it in the night, it was working perfectly. I have clicked on the exchange before many times and it was working perfectly. So that after was a coincidence.

Finally in the night, I exchange some coins and it worked excellently. Immediately I noticed that the coin has been confirmed onchain, it indicated on the exchange that the amount I sent to the address they displayed to pay to as been received. I used Dynamic rate which might be the reason for a little delay in the transaction. I think using flat rate would make the exchange faster. Immediately the exchange indicated that it has processed the transaction, I open my wallet and saw the coin.

As you are about to make payment, you can download a letter of guarantee that contain proof of the exchange order which contain the time you created the transaction to send coin to the address provided on the exchange, it also has the refund address. In general, it is a bitcoin signed message that consists of the information I mentioned.

After the exchange has received the coins that you sent, you can also download letter of guarantee which consist of proof of order and contain other information like the site (exch) which I used for the coin that I exchanged into another coin. It also contain the date of the order, the time, refund address, the amount they have received, the amount sent and their txids and the exchange rate used for the calculation. All these mentioned are also in a message which was signed with a legacy address private key (just the address shown, no private key shown, the address is also not funded). So it includes a bitcoin signature.

The address used to sign the message is a legacy address that ends with exch. I wonder the amount of computational power that would have been used to generate that uncompressed address.


Suggestions

What I will suggest is that the site should look more attracting, although it is very simple to use.

More coins should be supported. For now, it is supporting bitcoin, ether, litecoin, dash and three ERC20 tokens which are USDT, USDC and DAI.

Another suggestion is that if someone input the amount of coin he wants to exchange, the exchange should automatically display the person the amount of coins that the person will receive. I mean if the person input the amount of bitcoin he wants to send to receive moner as an example, the exchange should deduct the fee and automatically display the amount of monero the person will receive. Also the person can instead, input the amount of monero he wants to receive and the exchange will display the amount of bitcoin to send.





Although, it is not automated, but it can be manually done. After you input the amount of bitcoin that you want to send, or the amount of monero that you want to receive and you click on calculate, the amount you will receive will be displayed:





About refunded address

I intentionally did not include refunded address which I know it is for the purpose of error and inability to process an exchange successfully, the coin would be sent back to the owner. On the bitcoin signed message, the address I used to send the coin is the refund address. But I think because of privacy reason, users are allowed to provide a refund address which can be different from the address they use to send the coin. If no address is provided, the address you used to send the coin is the refund address. I think this is nice.


Supported bitcoin addresses
I tried other address type like multisig and pay-to-taproot addresses and all were accepted.


Do not try this, use the correct address
I edited the address to input different characters to make each addresses have exactly the same number of characters of their address types. Secondly, I later added more characters. Third, I removed some characters. The three brought up the same error:



I think that is good, but people should not send to a wrong address. Wrong but valid bitcoin addresses would be successful and your money will be lost forever.

This works the way you'd expect it to work The Letter of Guarantee doesn't mention anything about an amount, and the transaction page shows this:

So when I have set to exchange to 0.01 BTC to ETH, is there I have to send the amount of 0.01 BTC exactly?
What happens if I send it less or more for example I send 0.009 or 0.012? Will it be received according to what we sent?.

On the order set, I read that if I send 0.01 BTC I will receive 0.160154138151151 ETH (Network fee included). I think this exchange offered a very low fee and simpler transaction than the conventional exchange I tried. I think this is a big breakthrough in the future if they continue to maintain their service.

That's a good question I didn't have to wait long so can't say. If it's fixed or dynamic fees they've got to have time limits. It doesn't make sense for swaps staying open forever. We don't know so OP should answer it.

Yes if the reserve is empty you cannot receive XMR from eXch, you can only swap XMR for another coin, you're correct that there are no third party liquidity providers and eXch do not also refill the balance in the reserves themselves, the reserves only gets refilled when customers send those coins to them for swapping.
And it will also get refilled quicker because they are swapping one coin for another, and the coin they are swapping adds to the reserves.

They have some limited reserves for a few crypto and XMR wallets just seem to fill up slowly. As you can see below the screenshot, the current XMR reserves are zero, however  the last 24 hour volume for XMR was only 310. Also i can see only 1.4 LTC in reserve at the moment. If many people will use this exchange, I think the wallets will get emptied a lot quicker.

You need to be online and refresh the site to see if the XMR wallet loads up and you can make an exchange.

What's the deal with exchanging to XMR? I see that currently there is 0 reserves so I assume this isn't possible at present if there are no third party liquidity providers?

I created an order to see what would happen and I get the following:


Obviously there's something not quite right with that calculation if the maximum I can send is 0, but the minimum is 0.00000055.

Don't send BTC with a purging or low priority fee rate because it'll surely get stuck except the mempool drops. It is better if you pay a reasonable amount in fees so the transaction wouldn't stay unconfirmed for days, and it is easy to do by just checking the mempool before making your tx. Nevertheless i have gone through this thread and i don't think i've seen any time limit for orders, but only 1 confirmation is required to start the exchange, so you either pay an appropriate fee or bump the tx if it is stuck for too long.

They don't talk about any time limit for the order, which means you could wait for as long as your transactions gets the required confirmations. I bet the reason for the refund address is also for such situations where, by the time the order is confirmed, the coin you need in exchange is not available in the reserve.

I have also tested the service and really like their service. i have also bookmarked the site, in case i would be needing to swap the coins, i will prefer eXch.

However, there is one question in my mind after my recent bitcoin to XMR swap. I send the bitcoin to the eXch.cx address and it took a few blocks until my transaction was confirmed. (These days the mempool fees are quite high) and my order was executed.

In case, we send Bitcoin to them with less fee, how long the order will remain active and wait for the confirmations? Is there any limit to this or the order will remain active to receive confirmation of the transaction even if it takes few days?