Topic: Vulnerability in mmcFE Manual Withdrawal Logic (Read 1912 times)
I guess it should be pretty much seen and solved by all pool OP's by now. Unstickied for the time being.
Here is a quick fix that i posted in this thread.
one might want to clean it up a bit so you do not reuse variable names but it does work fine.
https://bitcointalksearch.org/topic/m.2533156
one might want to clean it up a bit so you do not reuse variable names but it does work fine.
https://bitcointalksearch.org/topic/m.2533156
Wow, thats some serious shit.
Check your ledger for debit_atp. You may find double payments there as well.
Stickied for the time being.
To: Any pool operator using mmcFE or any one of a dozen derivative forks.
A vulnerability has been discovered in the Manual Withdrawal logic that can allow Withdrawals to be duplicated.
The vulnerability is in accountdetails.php.
Essentially firing off several withdrawal requests in less than a second can sometimes allow multiple withdrawals to be processed.
Resulting in duplicate payments being sent before the first one completes and the users account balance is set to 0.
You should disable manual withdrawal until you can code a work around.
Details here : https://bitcointalksearch.org/topic/m.2416246
Moderator : you might want to make this thread a sticky as there are tons of pools based upon this code.
A vulnerability has been discovered in the Manual Withdrawal logic that can allow Withdrawals to be duplicated.
The vulnerability is in accountdetails.php.
Essentially firing off several withdrawal requests in less than a second can sometimes allow multiple withdrawals to be processed.
Resulting in duplicate payments being sent before the first one completes and the users account balance is set to 0.
You should disable manual withdrawal until you can code a work around.
Details here : https://bitcointalksearch.org/topic/m.2416246
Moderator : you might want to make this thread a sticky as there are tons of pools based upon this code.
Jump to: