Stats on malled transactions - page 6.

itod

legendary

Activity: 1974

Merit: 1077

^ Will code for Bitcoins

Quote from: Loozik on February 11, 2014, 03:58:25 PM

Would it be at all possible to estimate the value of double withdrawals (effected through malled transactions)?[/b] If the exchanges were tricked into resending 1k BTC then it's no problem. If they were tricked into resending 100k BTC, then we might have a big problem.

It's not quite easy to hide your identity from the exchanges, one mistake and you reveal your router's IP to them. After that you are at their mercy not to bring up criminal investigation at you. MtGox maybe will not chase somebody and report him to the authorities for 1 BTC, but for 1k BTC they would surely do everything to put whoever does this in jail.

GCInc.

hero member

Activity: 566

Merit: 500

Quote from: Syke on February 11, 2014, 12:09:03 PM

Malled transactions cannot steal coins.

You sure? It's pretty usual practice for Bitcoin merchants to update database upon transaction first seen in the network.

Usually funds are not released until confirmations come in, but I'm willing to bet there are businesses experiencing considerable losses because their bitcoind reports two incoming transfers while only one is valid.

Malled transactions never get even a single confirmation, right?

itod

legendary

Activity: 1974

Merit: 1077

^ Will code for Bitcoins

Quote from: dserrano5 on February 11, 2014, 03:56:56 PM

Quote from: itod on February 11, 2014, 03:51:41 PM

Only thing that is let to be uncertain is the TxID of the confirmed transaction, it can be either one of these, depending on the miner who finds the block which includes the transaction, that miner decides which one will be in the blockchain forever.

AFAIK the miner doesn't get to decide either, it takes the first (version of the) transaction it receives from the network.

Yes, that's what I've meant, "decide" was not the right term. One group of miners will receive original transaction first, the other group will receive the mutated one first. Whichever group submits solved block to the blockchain first "decides" which transaction is committed. Notice that whoever mutates these transaction must be very, very quick to be successful doing this, original transactions move across the network fast, and they have to beat them before they propagate to the majority of the network.

Loozik

sr. member

Activity: 378

Merit: 250

Born to chew bubble gum and kick ass

Quote from: Syke on February 11, 2014, 12:09:03 PM

Quote from: Loozik on February 11, 2014, 09:34:46 AM

Quote from: dexX7 on February 11, 2014, 09:33:03 AM

Don't worry, the amount of attempted double spends is irrelevant.

Just trying to find out if the exchange I am using will go bust Grin

Malled transactions cannot steal coins.

OK. Get it.

Quote from: Syke on February 11, 2014, 12:09:03 PM

MtGox is losing coins because they are allowing customers to perform a withdrawal, claim they never received it, and then MtGox manually sends them a new withdrawal!

It is my understanding that both Gox and Stamp allowed this scheme - both halted btc withdrawals.

Quote from: Syke on February 11, 2014, 12:09:03 PM

Does your exchange do that?

Gox and Stamp are my exchanges. I wanted to find out if there is a way to aproximate the value of double withdrawals from Gox and Stamp up till now.

E.g. someone finds a 7.95757474 BTC transaction from Gox address to a dishonest client's address on a certain day and next finds a corresponding doubled withdrawal of 7.95757474 BTC a few days later.

This is just an idea by a non-techie (me), so don't laugh at me.

Would it be at all possible to estimate the value of double withdrawals (effected through malled transactions)? If the exchanges were tricked into resending 1k BTC then it's no problem. If they were tricked into resending 100k BTC, then we might have a big problem.

dserrano5

legendary

Activity: 1974

Merit: 1029

Quote from: itod on February 11, 2014, 03:51:41 PM

Only thing that is let to be uncertain is the TxID of the confirmed transaction, it can be either one of these, depending on the miner who finds the block which includes the transaction, that miner decides which one will be in the blockchain forever.

AFAIK the miner doesn't get to decide either, it takes the first (version of the) transaction it receives from the network.

itod

legendary

Activity: 1974

Merit: 1077

^ Will code for Bitcoins

Quote from: klondike_bar on February 11, 2014, 12:56:38 PM

here is my concern situation:

You have a bitcoin-qt wallet with 3BTC
you send 1BTC to somebody, and the wallet also sends some BTC to a change address within itself
a malled txid repeats this exact same transaction, and is seen by the bitcoin-qt wallet

what happens:
a) your wallet shows a balance of 2BTC and an unconfirmed txid that will never complete
b) your wallet shows a balance of 1BTC because it thinks that there is 1BTC that you sent away waiting on confirmation
c) your wallet shows something else entirely because the change addresses get FUBAR'd

My biggest concern is that while these malled transactions wont cause clients/wallets to report the wrong balance for received transactions (because it never confirms the second deposit), what if it is incorrectly displaying balances after a SENT transaction is malled with a copied txid that the wallet sees in the blockchain and beleives you have asked toi send funds

None of the a), b) or c) you've suggested is correct, although a) is close. Your wallet will show 2 BTC, and one of the two transactions, original or mutated one, will be confirmed and included in the blockchain permanently. Only thing that is let to be uncertain is the TxID of the confirmed transaction, it can be either one of these, depending on the miner who finds the block which includes the transaction, that miner decides which one will be in the blockchain forever.

Bitcoin-qt wallet is completely unaffected by this problem, so there's zero chance you can lose funds. Unfortunately, exchanges can't use that wallet in a way single persons use it because they serve multiple accounts, so they make their own wallet software implementation. MtGox software is sub-par, and depends on the TxID to account for the payment, which is unacceptable, only inputs and outputs inside the transaction should define if the funds are moved or not.

nmersulypnem

full member

Activity: 238

Merit: 100

Can we get updated stats thus far today?

Carlton Banks

legendary

Activity: 3430

Merit: 3080

Any observable correlation with specific mining pool/s? Seems like a large number of successful id mutations

klondike_bar

legendary

Activity: 2128

Merit: 1005

ASIC Wannabe

here is my concern situation:

You have a bitcoin-qt wallet with 3BTC
you send 1BTC to somebody, and the wallet also sends some BTC to a change address within itself
a malled txid repeats this exact same transaction, and is seen by the bitcoin-qt wallet

what happens:
a) your wallet shows a balance of 2BTC and an unconfirmed txid that will never complete
b) your wallet shows a balance of 1BTC because it thinks that there is 1BTC that you sent away waiting on confirmation
c) your wallet shows something else entirely because the change addresses get FUBAR'd

My biggest concern is that while these malled transactions wont cause clients/wallets to report the wrong balance for received transactions (because it never confirms the second deposit), what if it is incorrectly displaying balances after a SENT transaction is malled with a copied txid that the wallet sees in the blockchain and beleives you have asked toi send funds

BitAddict

legendary

Activity: 1190

Merit: 1001

Quote from: Syke on February 11, 2014, 12:09:03 PM

Quote from: Loozik on February 11, 2014, 09:34:46 AM

Quote from: dexX7 on February 11, 2014, 09:33:03 AM

Don't worry, the amount of attempted double spends is irrelevant.

Just trying to find out if the exchange I am using will go bust Grin

Malled transactions cannot steal coins.

MtGox is losing coins because they are allowing customers to perform a withdrawal, claim they never received it, and then MtGox manually sends them a new withdrawal!

Does your exchange do that?

Why no one uploaded a video in youtube telling how to receive unlimited bitcoins using the malleability trick on MtGox? Grin

Syke

legendary

Activity: 3878

Merit: 1193

Quote from: Loozik on February 11, 2014, 09:34:46 AM

Quote from: dexX7 on February 11, 2014, 09:33:03 AM

Don't worry, the amount of attempted double spends is irrelevant.

Just trying to find out if the exchange I am using will go bust Grin

Malled transactions cannot steal coins.

MtGox is losing coins because they are allowing customers to perform a withdrawal, claim they never received it, and then MtGox manually sends them a new withdrawal!

Does your exchange do that?

dexX7

legendary

Activity: 1106

Merit: 1026

Quote from: btcash on February 11, 2014, 10:37:41 AM

Do you know where these 28k for "nonstandard transactions come from? Normal nodes do not relay them. At least that is what I thought.

Hm. I'm unable to draw any conclusions based on the debug.log, but I extracted some lines and put it up on pastebin.com:

Code:

"version" : 80500,
"protocolversion" : 70001,
"walletversion" : 60000

http://pastebin.com/raw.php?i=qbt1Mgpw (nonstandard transaction type)
http://pastebin.com/raw.php?i=D1xzU0FU (inputs already spent)

It appears that those non standard tx are not relayed, as you mentioned.

Edit:
Spam marketing/advertisement via dust transactions has nothing to do with the mallability spam bot.

FoBoT

sr. member

Activity: 658

Merit: 250

is this the same issue being discussed about blockchain wallet TM spam?
bitcointalk.org/index.php?topic=459874.0

also this is the same issue?
bitcointalk.org/index.php?topic=459845.0

this spam will hurt credibility of bitcoin and it seems to be related with all the exchange withdrawal slowdowns?

StarenseN

legendary

Activity: 2478

Merit: 1362

following

btcash

hero member

Activity: 968

Merit: 515

Quote

This did not yield any result, however there are more than 58k appearances of "ERROR: CTxMemPool::accept() : inputs already spent" and 28k for "nonstandard transaction type" since Jan 07, 2014. Maybe I'll give it a try later and group those by date. Thanks.

Do you know where these 28k for "nonstandard transactions come from? Normal nodes do not relay them. At least that is what I thought.

dexX7

legendary

Activity: 1106

Merit: 1026

Quote from: Jan on February 11, 2014, 09:18:40 AM

I don't know how to get the stats from bitcoind, but looking into my debug.log I see a bunch of messages containing "was not accepted into the memory pool"
Many of those may be mutated transactions.
You can get a feel of how many there are by executing this (on a unix box):

Code:

grep "was not accepted into the memory pool" debug.log | wc -l

This did not yield any result, however there are more than 58k appearances of "ERROR: CTxMemPool::accept() : inputs already spent" and 28k for "nonstandard transaction type" since Jan 07, 2014. Maybe I'll give it a try later and group those by date. Thanks.

Loozik

sr. member

Activity: 378

Merit: 250

Born to chew bubble gum and kick ass

Quote from: dexX7 on February 11, 2014, 09:33:03 AM

Don't worry, the amount of attempted double spends is irrelevant.

Just trying to find out if the exchange I am using will go bust Grin

dexX7

legendary

Activity: 1106

Merit: 1026

Quote from: Loozik on February 11, 2014, 09:22:17 AM

Is there a way to calculate how many btcs were stolen through these malled / assumed malled transactions?

This is not an useful stat to determine the amount of lost-due-to-whatever-reason coins and you'd need to ask the exchange or service provider for any data.

Don't worry, the amount of attempted double spends is irrelevant.

Jan

legendary

Activity: 1043

Merit: 1002

Quote from: Loozik on February 11, 2014, 09:22:17 AM

Quote from: Jan on February 11, 2014, 09:19:56 AM

No. Those numbers are assumed transaction mutations on the bitcoin network over the last few days

Is there a way to calculate how many btcs were stolen through these malled / assumed malled transactions?

I can't think of a way to do that, and frankly I wouldn't care. It seems that someone is trying to mutate all transactions right now, not only those from MtGox.

btcinsight

member

Activity: 104

Merit: 10

Quote from: Jan on February 11, 2014, 06:21:50 AM

Quote from: nibyokwy on February 11, 2014, 03:44:27 AM

Quote from: Jan on February 11, 2014, 02:33:15 AM

Two transactions with different hashes and with overlapping inputs.
The definition is not entirely correct as a malled tx is not a double spend.

it will result in one though if the user has also tried to spend the change output of the original transaction that was voided by the malleable one. this seems to be happening quite a lot based on network chatter. probably because the client allows spending the change while it's unconfirmed.

Correct. All wallets allowing spending unconfirmed coins-sent-to-self (bitcoin-qt included) are potentially affected.
If this trend continues wallets may have to abandon this practice until mallability issues have been resolved.

I had a similar issue about one year ago. I was using bitcoind offline to issue several transactions, and probably some were taking change from the previous ones.

Afterwards, I took all the generated txs with getrawtransaction and went broadcast them through a connected computer on blockchain.info/pushtx.

I then saw that some were refused due to already spent outpoints, and I think it might be the very problem you are talking about.

But as long as there is no real attack, just rescanning to reference the mutated txid for subsequent spendings should be sufficient right?

Topic: Stats on malled transactions - page 6. (Read 17391 times)