There was another exchange hacking incident today. Poor Poloniex seems to be involved in all these, but that is probably because it has all the hot coins. Last week a hacker withdrew a large amount of BTC from c-cex, bought ALL the DRK on the orderbook quadrupling the price to .007 and deposited it in Poloniex crashing the price of DRK by 90% to .0002!
https://asktom.cf/index.php?topic=485029Today, a hacker exploited a weakness in Poloniex's withdraw system. It was actually the first time Poloniex was responsible for its involvement in an incident.
https://asktom.cf/index.php?topic=499580For those concerned about how the gateway would have done, I do not have the balance checking in, but I am pretty sure I would have checked for positive balances. Also, I serialize ALL withdrawals from all customers. This actually could create a performance bottleneck, but I went the safer path. It is much safer to have just one withdrawal going at a time, especially if you have only one acct being withdrawn from.
In a separate incident, XCP protocol itself was hacked!
https://poloniex.com/correspondence.pdfThe fact that the hack used 2 of 3 multisig is kind of a spooky coincidence, but the vulnerability was due to how XCP credited and debited accounts, apparently hardcoding the withdrawal from the first input. Rest assured, that I validate each txout used as an input with the associated account. Plus what I am doing is MUCH simpler than what XCP is doing.
Now these events make me reiterate that before we go live with my gateway code, we must have it reviewed by an expert. I think it is in the community's interest to hire "Guy Fawkes" for this review!
Kudos to busoni who keeps weathering these attacks and does as good as anybody could expected to.
James
P.S. I have never been in Brazil!
