only 10 payout requests so far, considering this week, I hope it is ok to delay payouts till next friday.

a bi-weekly schedule seems more appropriate with so few requests

sorry about that, in the chaos I forgot to propagate the beta branch to master

just did it, so just pull, make and it should start mining. no need for resync since you already did

thanks!
it is nice to hear support, especially from legendary members

We had requested that exchanges prevent deposits and withdraws so the illicit KMD wont be able to be sold very early in the event timeline.

Unfortunately, cryptox.pl did not do this for many hours after our request and even after we were told trades were stopped, it continue via API. We specifically asked about API trading and were assured it was stopped.

Now, it seems another half a million illicit KMD has been sold?! This is after the main chain was resumed. And I can think of only one person who would sell at 250 sats... Which means the illicit KMD deposited is still active inside cryptox's system.

Clearly, we cannot take responsibility for such delays. So, we will be setting up a direct claims process for cryptox customers to use. cryptox doesnt have enough KMD to cover the KMD on the books due to all the illicit deposits that were accepted. This means your KMD balance at cryptox isnt fully backed by real KMD. The actual percentage backing it is unknown.

However, do not worry!

Here is the plan.

1) We pick a reasonable floor price that represents the lowest high volume price that would have been had only real KMD been traded. I am thinking a price like 5000 sats. this is about what the lowest price during the panic selling and well below recent prices.

2) cryptox customers who purchased illicit KMD as evidenced by trading timestamps, would be able to make a claim for the BTC used to pay for the KMD. Now if you already withdrew from cryptox into real KMD, then of course this wont apply as you are already fully covered.

3) We verify the claim with the cryptox data and refund the BTC.

Result: cryptox customers who paid BTC for illicit KMD get back 100% of their BTC and have no loss.

It really is too bad the cryptox deposits were not turned off when we asked as all of this would have been avoided. It will take us a bit of time to get some more detailed procedure for this, but I wanted to outline the basic plan. We need to define the first and last trading timestamp that will count, eg. certainly so that trades after the mainchain resumed are not eligible.

There are some strange trading patterns as evidenced by the trade log above, so we need to reserve the right to refuse compensation for suspicious cases. We can use this thread as an appeals process in case you feel we reject your claim without basis.

We will use common sense in the determination of compensation as this can get quite complicated and would take a long time to create a formalized set of rules that cant be exploited.

since bittrex promptly closed deposits when we requested, none of the illicit KMD entered their system. That means all the bittrex KMD is 100% backed by real KMD

which means there is no impact from any of this to bittrex and bittrex customers

it was an oversight in a special case of block validity checking. I had all the complicated pax deposit/withdraw totals matched up with pending cross chain swaps but there was a test for a special 2 vout coinbase as we use the second vout for the price feed data.

So it was testing for this special case properly, but the default path of the 2 vout coinbase (which cant be any pax tx) was set to ok, instead of error.

totally my oversight, and the case where you spend all your effort on the difficult part and dont check for the simplest exeptions to the simplest case. I will take a 1 million KMD responsibility for this and contribute that much to a cryptox make good fund. I believe the long delay from our request to stop deposits and when it was finally done was a contributing factor that made it go as big as 3.5 mil, but with 1 million KMD, that means at least one third of all the cryptox KMD can be made real.

this combined with the 25 BTC to make cryptox whole and I think we have most of the solution

I will use personal KMD for the 1 million contribution to the makegood fund.

it has been trading all along on bittrex.

I am recommending the other exchanges wait until at least after block 236200 before reenabling. A full resync is needed and that will also give us time to make sure we are indeed stable

our estimate is less than 25 btc
so to put it in perspective this is a relatively small event compared to historical

I have released a release candidate that is generating new blocks and the notary nodes are testing it. I think it has been about 12 hours since I first saw the attack, but if all goes well we will go from the current transition mining to free for all at 236000 and resume normal dPoW block generation.

Since I have been up for a while, I want to make sure we get past the transition to 236000 before onboarding the exchanges.

Would want a few hundred more blocks before the GPU pools come back in.

The result of this event is that 1.5 million KMD was created in the mainchain, but they are frozen, so the 1.5 million KMD isnt going anywhere. However, after it was announced that the chain will be stopped and restarted at 235300, the attacker started mining like crazy essentially creating his own chain. And with most of the block generation going offline, the attacker ended up with a lot of blocks which he stuffed full of illicit KMD.

bittrex had deposits disabled, so there was no illicit KMD traded at bittrexx
cryptopia only had a very small amount

but cryptox ended up with about 3.5 million illicit KMD, most of which traded at significant discounts to the bittrex market. We are currently working out what to do about that situation.

the mainchain doesnt have those 3.5 million KMD, most of it was mined on the attacker's private chain after notice of 235300. We realize people's concerns over their funds. Let me make clear that your KMD was not at risk during this entire episode. The potential dilution from massive illicit coins has been prevented.

I think the worst outcome for people would be that they wont make windfall profits from buying KMD at 200 sats on cryptox, yes some traded for that low. It is a balance between the interests of the low price purchasers and the community at large. This trading was with the illicit KMD and not the mainchain and it is too bad that we didnt have time for all the exchanges to block deposits.

Quite an eventful start to the week. KMD is generating blocks regularly again and with the exception of the cryptox low price buyer windfalls, I think all the other issues are now under control.

I will try to get some rest and hope for a clean resolution on the cryptox issue

we are working to fix this, will let you know when we fix it

this was unique to komodo

https://en.wikipedia.org/wiki/History_of_bitcoin

Quote
On 6 August 2010, a major vulnerability in the bitcoin protocol was spotted. Transactions weren't properly verified before they were included in the transaction log or blockchain, which let users bypass bitcoin's economic restrictions and create an indefinite number of bitcoins. On 15 August, the vulnerability was exploited; over 184 billion bitcoins were generated in a transaction, and sent to two addresses on the network. Within hours, the transaction was spotted and erased from the transaction log after the bug was fixed and the network forked to an updated version of the bitcoin protocol. This was the only major security flaw found and exploited in bitcoin's history.


The highlighted portion is essentially what has happened. For those that dont understand that a coin's emission and supply are the MOST important things for people to trust, I am not sure what to say. A coin that is allowed to be created out of thin air would lose a lot more trust than stopping the chain at an announced block in realtime and then doing what you said you would do

sent you a pm, i didnt link your handle to cryptopia until now

https://en.wikipedia.org/wiki/History_of_bitcoin

Quote
On 6 August 2010, a major vulnerability in the bitcoin protocol was spotted. Transactions weren't properly verified before they were included in the transaction log or blockchain, which let users bypass bitcoin's economic restrictions and create an indefinite number of bitcoins. On 15 August, the vulnerability was exploited; over 184 billion bitcoins were generated in a transaction, and sent to two addresses on the network. Within hours, the transaction was spotted and erased from the transaction log after the bug was fixed and the network forked to an updated version of the bitcoin protocol. This was the only major security flaw found and exploited in bitcoin's history.


The highlighted portion is essentially what has happened. The difference is that bitcoin knew about it for over a week, while we didnt find out about it until the attack was under way. Also, I announced in realtime block 235300, which is the stopping of a chain.

If there is a bug in the future that allows to totally bypass the coin emission, then we will fix that to. You can count on that.

the attacker is generating half the blocks now. that is pace of 3 million KMD per hour and would be for another 6 hours or so. So we are looking at more like 25 to 30 million KMD. and most all of this was AFTER I announce the chain would be stopped and rolled back to that point.

not sure how this is different from the bug that allowed to create bitcoins. allowing such coin creation to be upheld is not any immutability, but a total violation of coin emission.

this is not a rollback to bail out some exchange that got hacked.

the attacker has generated another 27 blocks in the last hour and at this pace he would generate much more than 10 million KMD by the 236000 block with the original bugfix trigger.

It is a bug that was not found by a white hat, but by someone who repeatedly exploits the same bug over and over.

I did not block the first exploit of the bug, that can be considered a bounty. But beyond that, it is like handing in the same thing over and over again expecting to be paid for it.

I never said the code is the law. The miner reward has been stated to be 3 KMD per block, not 100003 KMD. It is a chain stoppage due to a critical bug. People have relied on 3 KMD per block as mining reward, so to allow 100003 KMD as a reward would violate things a lot more than stopping the chain at 235300.

I will use common sense for this. Also, in the future if there is some other critical bug that dramatically changes what everyone's understanding is, then I will likely fix it and stop the chain, etc.

This was a bug in the code, actually it was code that was missing and allowed a vout to be created that wasnt constrained. It is closer to the billions of bitcoins bug.

I announced the block that will be rolled back to, pretty much in realtime, so it is more a stopping the chain at 235300 than rolling back. of course a few hundred blocks were generated during the time to make the fix. so yes, technically it is a rollback of a few hours, of the blocks that happened after 235300 was announced.

Let us not make a political circus out of this. It was a bug that was abused.

The attack started about 36 hours ago during the weekend. We detected it about 6 hours ago and had a fix that would go into effect at 236000. At that point the attacker would have had coins, but it would have been absorbable.

Then the attacker must have seen that things will be cutoff at 236000 and he went wild. He started a high frequency attack and started to move funds, even some z-transactions.

There were 15 blocks prior to 235300 with the illicit KMD in vout1 and the new version prevents any block with any tx that spends any of these 15 as invalid. Unfortunately, this will require a resync of the chain as the local DB has invalid blocks in it and even with the -rewind, komodod will be complaining.

If you are running native komodod, you need to update and resync. delete the usual blockchain files and komodostate in the ~/.komodo folder. Make sure to not delete your wallet.

The simplest is to leave the illicit KMD in the utxo where they are, frozen. So there wont be any dilution due to this.

An attacker has taken advantage of an exploit and is generating coins. We made a new version that would stop this at 236000 but the attacker ramped things up to levels that will force us to rollback the chain to 235300.

Please do not do any transactions until we get a new version out that solves this.

more details after this attack is over

the system needs to be configured properly first.
one way is to install the old version's installer first, then run the latest version.

the old installer gets the system setup right

it should only take a minute or less on startup

There is no record of Pangea IPO since there never was any IPO for Pangea. It was an external project that SuperNET invested in and I do believe there was a sharedrop where Pangea assets were given out for free.

Once people had the pangea asset, it started trading. it seems the uninformed assume that anything that is trading in the market must have had an IPO.

Instead of having received funds from a Pangea IPO, we have put money in. The original team ran into issues and I was asked to help with the core tech. Due to the circumstances of other projects, pangea has been on a lower priority, but I did make a proof of concept and there was even a decent GUI made by the original team.

Now that I am finishing up the DEX tradebot, along with JUMBLR, dPoW, PAX, assetchains, iguana core, pangea is rising to the top of the todo list. But I guess the trolls need something to criticize so they pick on one of the few things that I havent had a chance to complete yet. It is also at the end of the list as it will need to utilize the other tech.

Anybody care to make a wager on whether I will get pangea core done or not?