There is no way to minimize the "financial damage" by reporting it privately, except to allow insiders to trade ahead of everyone else. Brilliant idea.

If the report were untrue, that would be a different matter. It certainly was true. If anything, more financial damage was caused by the false "Deanonymized? Nope" statement put out by the Shadowcash team about the report being incorrect and that it couldn't be reproduced after 10 hours of work by your core developers. That may have misled people into making trades on the basis of a false statement (yours). That's what I call financial damage.

Maybe you guys should have worked on it privately instead of making a statement to (falsely) calm the market when you didn't know what you were talking about.

First of all you don't know his incentives. I would submit to you that his incentives as a mathematician are to publish (what he sees as) interesting math stuff, including identifying math errors in cryptocurrencies.

As far as "the first rule of ethical disclosure is to minimalize damage" what you do not seem to understand in this instance is that there is no way to further minimize the damage, aside from informing users as quickly as possible so they stop using the broken code (and take whatever measures are possible to mitigate the damage that might exist from thinking their transactions were untraceable when they in fact were not). The damage is already done and is already on the blockchain, out there forever.

This is not a case of an "exploit" that can be reported privately to developers to fix it before anyone can use it. The blockchain is there and can't be fixed.

If you guys want to weasel out of a bounty on the basis of the mechanism of reporting, then do what you're gonna do. You'll be known as the scam devs who didn't pay out on a bounty after someone fully deanonymized their chain instead of just the coin that had its chain deanonymized due to a math error. Pick your poison.

MoneroHouse bids 65 mil.

That will never happen because any voting or consensus type system gives disproportionate, not proportional, weight to the larger holdings.

Shen updated his blog post and now provides code demonstrating the bug on the actual SDC blockchain, so it turns it his analysis of the math was correct after all.

https://shnoe.wordpress.com/2016/02/11/de-anonymizing-shadowcash-and-oz-coin/

Shouldn't you be off in some walled garden controlled investor-fleecing forum somewhere?

It's about 100k lines (including blanks -- simple file line count). Good luck figuring out what all that code does, how it is being used, where it came from, whether it has unpatched bugs, etc.

If you read shen's blog post he explained it. He identified the potential flaw first and then looked to see if any coins were implemented in the broken manner. He found one that isn't even a launched coin, more of a proof-of-concept, as well as SDC.

A ring signature has multiple possible signers. The idea is that it is suppose to not be possible to tell which previous transaction's output is being spent.


In the case of the broken ring signatures in Shadow, you can always tell which leader gave the order (which transaction's output is being spent).

There is another issue with plagiarism besides credibility and hype, which is that when you write code yourself you likely have some idea what the code actually does. When you run it through an automatic reformatting/refactoring tool in order to disguise the copying you very likely have no idea how the code actually works.

You also can't do any automatic or easy merges. It was already pointed out on one of the other threads that VNL had carried forward a bug (implausible if it were actually new code) that had subsequently been fixed in Bitcoin, yet ignored in VNL.

This played out recently in the case of SDC, who copied the cryptography from Cryptonote (but not the code, which they reimplemented). They did not understand how it worked and ended up reimplementing it incorrectly, leading to total deanonymization of their entire chain.

The large portions of the VNL code that were ripped off from BTC are almost certainly not fully understood by the developer, likely contain multiple unfixed bugs, and will be harder (likely to the point if impracticality for a small one-man project) to maintain due to the unnecessary reformatting/refactoring.

The SDC portion was always equivalent to BTC from a privacy perspective (except for being less used which likely makes it worse in practice).

The Shadow portion has functioning (afaik) stealth addresses but the ring sigs did not function. That makes it equivalent to BTC where addresses are never reused. No 'mixing' function.

Honestly I can't say I blame you. There is a lot of FUD and trolling and false claims that go on here, this just didn't happen to be one of them, as it turns out.

Anyway, the i information is out now, and it will be up to your team to decide how to address it. Ideally it gets fixed.

Signing off from the thread for now unless anyone has a question for me.

I'm not positive but I think both ring sig versions have the flaw.

The code can be fixed, going forward. Incompetence is harder to fix.

It matters exactly to that, because first of all it is used to hype ("All new code!") and based on that observation you should seriously doubt whether the product is being sold on the basis of code that works or hype. In this case clearly the latter.

Second of all it tells you a lot about the credibility and integrity of the developer. Unless you are going to undertake a comprehensive top-to-bottom review of the design and code which done right could cost millions of dollars, you are unavoidably relying on his claims about what the code is supposed to do and what it actually does. In theory the code speaks for it self but in practice when there is zero chance of a competent and complete review ever being done, the credibility of the developer matters a lot.

As TPTB just said, at this point he hasn't even released a complete white paper for any of the features. So it can't be reviewed that way even if we were willing to take his word that the code does what the whitepaper says. It's all bunch of skin-deep hype for a pump.

You issued this:

https://blog.shadowproject.io/2016/02/12/deanonymize-shadow-nope/

"We would like you -our dedicated users- to know that, after 10+ hours of testing by Shadow’s core developers, our team has not yet managed to deanonymize any private transaction."

If so, then you either lied about your core developers being unable to write a few lines of code in a 10 hours, or they aren't able to do so. I don't know which.

They can if they have any idea what they are doing. After 10 hours of work which would have required a few lines of code to reproduce, all they could do is issue a false denial.

Proof of concept code has been posted by shen:


BTW, shen has a file with every single ring signature from the chain broken. Anyone can reproduce using the code from his blog.

EDIT: https://raw.githubusercontent.com/ShenNoether/Deanon/master/sdcDeAnon.txt

Dude:

signer is index 3

Do you know what that means?

Shen has a file with every single ring signature from the chain broken. Anyone can reproduce using the code from his blog.

EDIT: https://raw.githubusercontent.com/ShenNoether/Deanon/master/sdcDeAnon.txt

Proof of concept code has been posted by shen:

The other coin's code is (or at least was) forked from BBR so in principle improvements that are consistent with the direction of the BBR project could be merged back, license permitting. I don't know of any other connection.