<div dir="ltr">Simon - tx hashes or it didn't happen<div><br></div><div>Kidding aside, would be great if you could share the confirmed and double-spent hashes so the rest of us can dive in and learn from this. </div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jul 16, 2015 at 7:50 AM, Me via bitcoin-dev <span dir="ltr"><<a href="mailto:bitcoin-dev@lists.linuxfoundation.org" target="_blank">bitcoin-dev@lists.linuxfoundation.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><span class=""><div><blockquote type="cite">minrelaytxfee setting proposed in the 0.11.0 release notes</blockquote></div></span><div>my guess, he is talking about this <a href="https://bitcoin.org/en/glossary/minimum-relay-fee" target="_blank">https://bitcoin.org/en/glossary/minimum-relay-fee</a> - slam dunk technique for doublespend</div><span class=""><div><br></div><div><br></div><div><br></div><div><blockquote type="cite">Related: is there somewhere a chart that plots `estimatefee` over<br>time? Would be interesting to see how the fee market evolved over<br>these past weeks.</blockquote><br></div></span><div>I find this useful</div><a href="https://bitcoinfees.github.io/" target="_blank">https://bitcoinfees.github.io/</a><div><div class="h5"><div><br></div><div><br></div><div><br></div><div><br></div><div><br><div><blockquote type="cite"><div>On Jul 16, 2015, at 7:30 AM, Arne Brutschy via bitcoin-dev <<a href="mailto:bitcoin-dev@lists.linuxfoundation.org" target="_blank">bitcoin-dev@lists.linuxfoundation.org</a>> wrote:</div><br><div><div>Hello,<br><br>What are these pre- and post-Hearn-relay drop rules you are speaking<br>about? Can anybody shed some light on this? (I am aware of the<br>minrelaytxfee setting proposed in the 0.11.0 release notes, I just<br>don't see what this has to do with Mike Hearn, BitcoinXT, and whether<br>there's a code change related to this that I missed).<br><br>Related: is there somewhere a chart that plots `estimatefee` over<br>time? Would be interesting to see how the fee market evolved over<br>these past weeks.<br><br>Regards<br>Arne<br><br>On 15/07/15 05:29, simongreen--- via bitcoin-dev wrote:<br><blockquote type="cite">With my black hat on I recently performed numerous profitable <br>double-spend attacks against zeroconf accepting fools. With my<br>white hat on, I'm warning everyone. The strategy is simple:<br><br>tx1: To merchant, but dust/low-fee/reused-address/large-size/etc. <br>anything that miners don't always accept.<br><br>tx2: After merchant gives up valuable thing in return, normal tx<br>without triggering spam protections. (loltasticly a Mike Hearn<br>Bitcoin XT node was used to relay the double-spends)<br><br>Example success story: tx1 paying <a href="http://shapeshift.io" target="_blank">Shapeshift.io</a> with 6uBTC output<br>is not dust under post-Hearn-relay-drop rules, but is dust under <br>pre-Hearn-relay-drop rules, followed by tx2 w/o the output and not <br>paying <a href="http://shapeshift.io" target="_blank">Shapeshift.io</a>. F2Pool/Eligius/BTCChina/AntPool etc. are all <br>miners who have reverted Hearn's 10x relay fee drop as recommended<br>by v0.11.0 release notes and accept these double-spends.<br><a href="http://shapeshift.io" target="_blank">Shapeshift.io</a> lost ~3 BTC this week in multiple txs. (they're no<br>longer accepting zeroconf)<br><br>Example success story #2: tx1 with post-Hearn-relay drop fee,<br>followed by tx2 with higher fee. Such stupidly low fee txs just<br>don't get mined, so wait for a miner to mine tx2. Bought a silly<br>amount of reddit gold off Coinbase this way among other things. I'm<br>surprised that reddit didn't cancel the "fools-gold" after tx<br>reversal. (did Coinbase guarantee those txs?) Also found multiple<br>Bitcoin ATMs vulnerable to this attack. (but simulated attack with<br>tx2s still paying ATM because didn't want to go to trouble of good<br>phys opsec)<br><br>Shoutouts to BitPay who did things right and notified merchant<br>properly when tx was reversed.<br><br>In summary, every target depending on zeroconf vulnerable and lost <br>significant sums of money to totally trivial attacks with high <br>probability. No need for RBF to do this, just normal variations in<br>miner policy. Shapeshift claims to use Super Sophisticated Network<br>Sybil Attacking Monitoring from Blockcypher, but relay nodes !=<br>miner policy.<br><br>Consider yourself warned! My hat is whiter than most, and my skills<br>not particularly good.<br><br>What to do? Users: Listen to the experts and stop relying on<br>zeroconf. Black hats: Profit!<br><br>_______________________________________________ bitcoin-dev mailing<br>list <a href="mailto:bitcoin-dev@lists.linuxfoundation.org" target="_blank">bitcoin-dev@lists.linuxfoundation.org</a> <br><a href="https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev" target="_blank">https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev</a><br></blockquote><br>-- <br>Arne Brutschy <<a href="mailto:abrutschy@xylon.de" target="_blank">abrutschy@xylon.de</a>><br>_______________________________________________<br>bitcoin-dev mailing list<br><a href="mailto:bitcoin-dev@lists.linuxfoundation.org" target="_blank">bitcoin-dev@lists.linuxfoundation.org</a><br><a href="https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev" target="_blank">https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev</a><br></div></div></blockquote></div><br></div></div></div></div><br>_______________________________________________<br>
bitcoin-dev mailing list<br>
<a href="mailto:bitcoin-dev@lists.linuxfoundation.org">bitcoin-dev@lists.linuxfoundation.org</a><br>
<a href="https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev" rel="noreferrer" target="_blank">https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev</a><br>
<br></blockquote></div><br></div>