Bitcoin Forum

Hey guys.. in the wake of the Asiacoin mega-scam.  We've been doing some forensics on the code to understand the premine scam.. my full analysis is listed here:

https://bitcointalk.org/index.php?topic=566870.msg6535095#msg6535095

This code was also found in SHACoin, which had the exact same premine SCAM that was exposed a week earlier.

cruncher on IRC had a great suggestion to search all of github for a particular string that was associated with the obfuscating premine.

The segment of code resides in the RPC call, that seeks to intercept the amount of coin by returning a modulo version of it.

The result of that search is here:  "https://github.com/search?p=1&q=amount+%25+%28MAX_TX_FEE+*+COIN&ref=cmdform&type=Code"  (https://github.com/search?p=1&q=amount+%25+%28MAX_TX_FEE+*+COIN&ref=cmdform&type=Code)

As you can see the string shows up in a bunch of other places (including the AsiaCoinFix repo i pushed up for the forensics exercise).

The following hits to coins were identified:
  EverCoin - never heard of this
  RainbowCoin - recently launched
  ShaCoin - known premine scam
  ccc/qbcc - ??
  BeeCoin - ?
  QuarkBar - premine scam found,  patched



Now it may be the case that some devs accidentally forked a code repo unknowingly.. or the coin has already found the issue and patched it, or maybe this isn't even the original location of the code..

I didn't check the actual blockchain itself to verify.  This is just from a github search using the "obfuscation code"..  But if this code is deployed even without knowing.. it really ought to be patched up anyhow.

Up to everyone's own due diligence to check their own coins now..

QuarkBar is a scam coin? Are you sure?

No I am not sure.. that's why I said potential.  The "malicious" code exists in that code base on github.. that's all we know.

If someone can verify and get back to this we can certainly eliminate it as a candidate.

Quarkbar's original dev also gone. Now community took over this coin, but i don't know whether or not that community know about this premine. You should put a warning on their thread.

We're looking into this. We were not aware of this at all.

micryon, thanks for your effort, i have a small question.

If scammer publish clean source code to github but he compile clients with malicious codes included, then how can we know ? Few people will take that 'clean' source and compile for themself, but this will cause conflict with those clients compiled by dev, right ? Then how can we know if that case happen ?

I'm just asking because i think in future, those scammers will find a more sophisticated way to scam.

QuarkBar Community dev here. Thanks for the post!
We're looking at the code and going to patch it out asap.

Afaik, there's no way to know what's in the compiled binary they distribute, unless you compile it yourself.. and/or they release a sig'd build (which .. apparently no one does).

However, you are correct that if the key areas of the code do not match up.  Things like Checking transactions, Accepting block hashes.. rewards, etc.  Then those clients will not connect with each other.

The key to all this is 3rd party exchanges and pools.  By in large they are all 100% Linux, and must build from source.. so if you can't connect to them (accept blocks).. then you know that there's something different with your client.  

All coins require those ecosystem infrastructure, which has to be built from source...


This is the reason that the perpetrators of these scams do actually have to release the source, that is basically the same as the compiled binary.. They can do a few things like RPC call diffs, remove seed addresses, or inject trojans in the compiled binaries tho..

Excellent work. I am so lucky I pulled out of AC when it started to drop like a rock. I think it's really bad news for crypto
and alt coins that AC managed to happen. It probably took some people out permanently.

I think the burden should be on the Exchanges to catch these things.
It's 100% their responsibility I would say. They make the money off them and list them as fair products.

could you please check the latest coin? capitalcoin that just announce its existance.

Sorry you are going to have to check yourself, source is not posted on github.. 30 mb download taking an hour to get that source in .rar format.. (that in itself is a little suspicious tho..)

Yes you're right .. fixing premine situation is very difficult.. I'm just giving people a heads up, is all .. no solutions here unfortunately... :(

QuarkBar Community Dev here again.

We fixed the upstream code and hardforked the chain effective immediately.

Thank you the reporting

//Edit:
We're doing the maths to check if and how many scam-coins have been created so far

Allcoin will freeze the market, so in this insecure situation, we can prevent a bit of panic.

Hi there, I want to compile clients from source from now on, where should i look for a good guide on how to do it ?
I have very limited programming skill, i occasionally deal with PHP and HTML only.

many thanks  :)

It is kind of a bitch to do.. but here's the guide: https://bitcointalk.org/index.php?topic=149479.0

Bee coin isn't scam there is new dev and he's changing algo from POW to X11 POS, you should read befor telling shits.

There are alot of changes coming with Bee , better hold it for now.
I'm the new Dev working on Bee and will update as needed.

For the moment Bee is in a transition phase to X11 with POS so I believe you can assume we are on the safe side.

~SoopY~

Stay away from all the coins you are not sure of. That is around 99% of that alt-xxxx!

yeah it may be nothing.. but just giving you guys a heads up.. might want to patch that code, regardless tho, it's just .. wrong :)

Quarkbar is patched, but we will have to look into the total amount of coins.

I'm trying to get an idea of the total amount of Quarkbar coins held by bitcointalk users. Please PM me the amount and vote in this topic:
https://bitcointalk.org/index.php?topic=595204.new#new (https://bitcointalk.org/index.php?topic=595204.new#new)

Only use coins that fork trusted repos or.. this.

The ValueFromAmountWithFee function in itself is innocuous.
It seems to return the value of transaction in case that the tx fee exceeds the maximum.

To see where it is used to hide premine, I searched for line


The results are here

https://github.com/search?q=ValueFromAmountWithFee%28pindexBest-%3EnMoneySupply%29&type=Code&ref=searchresults

The first coin to pull the scam is
SHACoin

followed (knowingly or not) by
Evercoin
RainbowCoin
Asiacoin
xxxcoin

This clears Beecoin and Quarkbar of suspicion.

That is great news! :)

Thanks!

Just an FYI, the Rainbowcoin on that list is not the same one as the SHA256 one (https://github.com/Rainbowcoin/Rainbowcoin).

Dygus could you please link to the source of your information?

Also how does changing algorithm now affect the blocks (that may have been) pre-mined? The OP isn't claiming BeeCoin is a scam just pointing out a potential vulnerability. Don't shoot the messenger because you don't like the news they bring.

If you want to help Beecoin make sure the dev sees this tread.

Disclaimer: I  own a small amount of of Beecoin (<50K) that I acquired while researching mining.

Thanks

right!

Love QB, glad it was cleared

Same here :)

I can confirm that Quickbar and Beecoin does NOT have the other markers of the premine hiding (that exists in main.h and main.cpp).  So it was probably is nothing.

Though that code fragment still seems incorrect and should be patched even if harmless.

You've done great work on this, btw. Impressive that you found it!

Beecoin's resurrection plan is on the move for quite some time. Check it out here:

https://bitcointalk.org/index.php?topic=559876.0;all (https://bitcointalk.org/index.php?topic=559876.0;all)

so ... i guess some of these did turn out to be scams?

rainbowcoin is no premine scam i mined that from the very first block.u need to stop making false accusations and do some research .u are a complete moron

There are at least two coins of the same name. LGBT isn't the one with hidden premine.

Hmm just found out that Quarkbar did indeed have a premine.. found 20 days after i posted this. 

Do your own due diligence people, this is just from a github search with scam code.. you make your own decisions.

We managed to get rid of 98% of the malicious Quarkbar coins luckily and were able to freeze his trading account at an exchange. :)