Topic: MTGOX hits $570 "A bug in the bitcoin software makes it possible for someone to" (Read 3468 times)

LOL! It's vulnerable. I can change the transaction ID in the block still and if you are using the transaction ID to track the payment it'll appear gone to you. Your client will notice the new tx as it gets broadcasted to it but it won't "know" that its actually the other tx.

Of course the client does not "lose" the BTC, no client that I know of does that when the txid is changed in transit.

Oficiall bitcoin-QT will correctly identify spent coins even if tx id is modified by third party.
You can download from here: https://bitcoin.org/en/download
You can send 1 BTC to 1ZePhramiDqjYJzqiyUFaY5qhz5k4unRC
 

Oficiall bitcoin-QT will correctly identify spent coins even if tx id is modified by third party.
You can download from here: https://bitcoin.org/en/download
You can send 1 BTC to 1ZePhramiDqjYJzqiyUFaY5qhz5k4unRC
 

Not that Bitcoin-QT handles Malleability fantastically – but because it tracks inputs it will still detect the mutant transactions. An interesting point which I haven’t pointed out elsewhere is that for the question of basic funds safety in re-issuing a transaction malleablity is basically irrelevant.

Say you pay someone and it doesn’t go through (or it does and you don’t see it because its been mutated and your software can’t detect that), and they ask you to reissue…. if you reissue without double-spending any of the original inputs you are at risk of getting robbed. This is true with or without malleability. Without the double-spend of at least one input the original transaction could just go through in addition to your reissue.

Say that you do make sure to double spend at least one input – then the result is funds safe safe, regardless of if a mutation happened.

Say you want to support _canceling_ a payment (send me the goat instead!) rather than reissue you still must double-spend the attempted payment to cancel it, since it still might go through if you don’t. And the double spend works to protect this case regardless of if the transaction was mutated.

For support and accounting purposes you absolutely do need tools to identify mutated transactions, so long as mutation exists… so we ought to provide some better tools there. But I can’t think a case where mutation handling is necessary or sufficient for cancellation security, but – rather – input tracking appears to be both necessary and sufficient in all cancellation cases.

This helps explain why Bitcoin-QT – whose mutation handling kinda stinks – doesn’t ever end up in a really bad situation with mutants: it tracks inputs pretty well.

Nope wrong. There are none. If you can find one thats available right now I'll pay you 1BTC. I'm putting my money where my mouth is.

no one knows how much was stolen. It's quite difficult to noticed 10BTC missing out of hundreds of thousands. You could easily write that off as a mistake. That could be extra transaction fees that accumulated.

Can they not just go back to such conversations with people that claimed this, and then figure out who was scamming them? Is there some sort of plausible deniability here for the scammer in this method that I'm missing, or not?

...

I then tell MtGox staff that transaction A didn't confirm. They check it and they see transaction A was rejected and will never confirm but what they don't realize is it was just changed to transaction B by me, so they resend the transaction.



Profit.

Your misunderstanding here is how it works

I deposit money into gox and withdraw it

mtgox sends it to my address and it get transaction ID A

I mine a block and include the transaction in my block, but as the miner I can CHANGE THE TRANSACTION ID TO B.

I then tell MtGox staff that transaction A didn't confirm. They check it and they see transaction A was rejected and will never confirm but what they don't realize is it was just changed to transaction B by me, so they resend the transaction.



Profit.

It's not their fault bitcoin is broke... 

Your misunderstanding here is how it works

I deposit money into gox and withdraw it

mtgox sends it to my address and it get transaction ID A

I mine a block and include the transaction in my block, but as the miner I can CHANGE THE TRANSACTION ID TO B.

I then tell MtGox staff that transaction A didn't confirm. They check it and they see transaction A was rejected and will never confirm but what they don't realize is it was just changed to transaction B by me, so they resend the transaction.



Profit.

And no one knows how long it took for them to notice that numbers don't quite line up in their balance sheet...

Your misunderstanding here is how it works

I deposit money into gox and withdraw it

mtgox sends it to my address and it get transaction ID A

I mine a block and include the transaction in my block, but as the miner I can CHANGE THE TRANSACTION ID TO B.

I then tell MtGox staff that transaction A didn't confirm. They check it and they see transaction A was rejected on the blockchain but what they don't realize is it was just changed to transaction B by me, so they resend the transaction.



Profit.

You're technically correct on that point. But it's only one exchange, mtgox, that allowed this limitation to grow unchecked into a major problem, you agree? The problem is removed if only sufficiently* confirmed transactions are accepted. (* I'll admit I don't know how deep into the chain they need to be before the risk is neutralized)

Please find me a wallet that prevents the transaction ID from being modified in-transit. Thats all I said. There are none so if your tracking payment by transaction ID's which is something almost everyone does then your vulnerable.

Who wants to keep their wealth on service that doesn't exactly track their funds or audit them regularly?

Any bitcoin-QT since 2012 idiot.