Hmm, almost. You deposit money into moneypot, and there only you can touch it. You can instantly transfer money to an app, and there an app can do what ever it wants with your money, such as betting or  even stealing it. If you deposit X from MP to an app, you need to explicitly trust the app with X. Until the money is back in your main moneypot balance, it's completely at the mercy of the app itself.

MP also offers a set of APIs for apps, most prominently betting against a bankroll that they do not control. (That way investors don't need to trust apps).

I originally did something more akin to what you were talking about, but it became *way* too complex for end users (configuring the type of bets, how many bets, how much EV etc.) that apps could have permission with. I even had a "refill permission" and audit feature.  But users find it much simpler to just transfer balances between apps, and each app has their own per-user balance.

Would be pretty easy in theory. Send the bet to moneypot as attempting to win 90 BTC, but present it to the user as attempting to win a 72 BTC jackpot. If win, use the tip API to send 18 BTC to an account that collects the fee.


(No idea if that's what they're doing, however)


Actually it's kind of devious.  A "smart" casino could make every bet with as minimal house edge as possible, (which would push investors to 3.33x kelly =/) and then use the tip API to send the money to the app. So from the gamblers perspective the house edge would still be 1%, but investors get screwed with negative expected bankroll growth  and MP itself would make no commission, but the app would make a significant amount more.

What about in the case of worthyou: https://bitcointalk.org/index.php?topic=1454521.msg14704015#msg14704015

He by all accounts is a legitimate player, who accidentally bet over the limit in a small number of bets? According to his side of the events (which were never rebutted) that appeared to result in his entire account funds being confiscated?

(There's also a few other accounts of the same thing happening with larger amounts of money as well)

I find the rubies thing rather perplexing.

So rubies are an altcoin that betterbets gives out, when people gamble on the better bets site? On the website they refer to it as "bet mining" but obviously that's not a real thing. I assume it means that betterbets either has the ability to issue new coins? or betterbets is sitting on a big premine of coins that they give out?

And what's the incentives here for MoneyPot to establish a guaranteed price floor? And what about all the other moneypot casinos, people only get rubies if the gamble on one of the moneypot casinos? Has MoneyPot have set aside enough money to buy 100% of all outstanding rubies?

Not to take away from your being scammed (if the chat logs are unmodified) but the terms of the deal should have been a huge red flag. No one can sanely offer to cover your downside but let you keep the upside, which also means he'd be a lot better off just making those trades himself.

I strongly doubt you'll find much intersection between the sets of people who make money from trading and make money from teach people to trade.

Rofl, where have I heard that exact same thing from?  



Because it's predatory? No one should have all their money forfeited because of a mere accident or misunderstanding. If taken to court, there is almost a zero percent chance that bitstarz would win as it's a text book example of an unconscionable clause.

See: https://en.wikipedia.org/wiki/Unconscionability

You did that correct. The house edge at 2x is indeed 0.5%  (see: bustabit.com/faq#odds for a nice chart)



The chance of busing at 0x, is actually 1 in 101 -- but it doesn't impact the house edge at all. (Because in the other 100 out of 101 games, the site gives out 1%). Making the whole bonus/instabust scheme 0 EV

It means how much you bet. The name is a vestigial leftover from the time you joined a room to bet a certain amount of money. (But now there's only 1 "room" and you can bet how much you like)

Yeah lol. I guess if you've ripped the IRS off, you're feeling scared and not thinking straight.

The most devious scam along those lines I've heard, is they find a husband and wifes phone number. They call the husband when he's at work and pretend to be the phone carrier: "Hey, this is AT&T, we're calling to let you know we're upgrading your phone speed! blah blah blah. But you will need to turn your phone off for 1 hour, is that ok?"

Then after the husband turns off his phone, they call the wife and tell her they've kidnapped the husband -- and she needs to immediately transfer money or he's going to be killed. Then they send her the transfer details. Obviously the first thing she tries to do is contact her husband, but can't and then makes the transfer.

Truly awful :/

Are you sure it's not just an empty threat? I've got quite a few threats asking for money, with *zero* follow-through, just in the off change they get paid. Every time someone serious has attacked one of my sites, they've always DDoS to the point it's offline, with the timeframes of when the demo attack will stop and then asking for money before the attack goes on again. Although even they have tended to get bored pretty quickly when it's obvious they're never going to get paid.

Cloudflare actually made a good blog post about some of the fake ddos threats: https://blog.cloudflare.com/empty-ddos-threats-meet-the-armada-collective/

Here's the saddest part:

Yeah, paying those assholes is a lose-lose situation. You support a criminal, and set yourself up as a sucker who is known to give out money. It's a lot better to be known as someone who won't pay a cent even if your site goes down, than someone who will.

Keep fighting the good fight  

Yeah, seems fine. Based on the bet stats it seems the the bet was ~2.766x kelly, and I believe investors will back any bet up till a 3.333x

I personally disagree with such leverage, but there's definitely some legit reasons to do so  (namely attract gamblers who would otherwise find the limits too restrictive, and allow investors to deposit less but still risk a lot, to minimize counter-party risk). It's what investors signed up to, so it seems fair (and it's certainly a lot less risky then the guy doing the gambling)

Ouchies, that's like 10% of the bankroll in a single bet?  


Hmm, a "jackpot style bet" is a very interesting case. Because it's so accessible to players (they can do it with only a few bits),  it allows virtually anyone to push investors into negative bankroll growth. I'm not sure what the house edge of the game, but let's just assume it was 15% and the gambler was aiming to win 10% of the house bankrol. From investors point of view, their EV would be 4.5% of what ever the gambler is betting (0.3 * 0.15) -- however, they're risking 10% ... which puts the investment a 2.2x kelly risk each bet (and any kelly above 2 means investors should expect to lose money over the long term).

(Although, I could be off base here, if the house edge was > 20%, then that's totally fine. Investors just got very unlucky).

Anyway, congratulations to the winner! Pretty incredible win

Another couple of big winners on bustabit:

gohard for 164.3:


and

inside for 127.6 BTC:





(Apologizes for the spam, but it sucks to lose 300 bitcoin and not get at least some marketing material out of it  )

The player in question accidentally broke some of the fine print on the terms of service by betting too much. He was neither stopped or warned by the software. When he won money from unrelated bets, that were not in excess of any casino limits, his entire account balance was cleared only when he wanted to withdraw.

Those are the facts. If you're cool with that -- then bitstarz sounds like a great casino, and I'd encourage you to play there. I personally would've been horrified if it happened to me, and view it as pretty scammy behavior. Apparently I'm not the only one

I've made numerous suggestions to betstarz how to make their policy more fair  (e.g. revert ALL violating bets, be them wins or loses) but they've shown zero interest in actually doing right by their players. That said, if they fix their policy (which they say they're doing) and return the misappropriated funds to players they've taken, I'd be more than happy to remove my negative trust as I'm sure would some of the other people who have left it as well.

::sigh::

That's just rolling back the database, and not what I meant at all. A replayable log is logging all the individual events (e.g. bets, investments and divestments), in such a way that if you found a mistake had occurred (or in this case, fraud) you could fix the mistake (in this case, delete the bets) then replay everything so the investors balance is exactly is if the fraud never occurred in the first place.

It's actually just a good practice to be in, when ever I mutate state I *always* store the cause of it. (e.g. if someone transfers money, I log an event of the transfer. If someone claims the faucet, I store the details of that, if someone invests I store a record of it (and things like how much the bankroll was before they invested) etc).

And probably the other mistake people make, is over-constraining their database to not allow negative values. e.g. While a user balance never should be negative, the system should support it as cases like this might cause some accounts to legitimately be negative (them withdrawing gains they shouldn't have) or even deposits reverting after a blockchain reorg etc.

It's great for a disaster recovery situation like this, and it's great from an audibility perspective. It's probably too late for this time around, but it might be worth designing around in the future.

Yeah, that's how it sounds like. Actually when I designed the moneypot investment system, what I did was create a repayable log of all the investment/divestment/bet events for in a nightmare situation like this (or software bug) it could be replayed so investors wouldn't have made/lost money from the changes in the bankroll when a fake better (or software bug) was playing.

The situation is probably a big mess now, as some investors have lost more than they should've and others made more than they should've. And it's probably pretty likely the ones who unfairly made money have already withdrawn (?) or at the very least, will be unhappy if their balance gets put to the correct amount

If the attack was super simple (e.g. the server was blindly giving the user the server seed) it's also possible it was a non-sophisticated attacker that got hold it of it, and was just dumb enough to not even try to cover his tracks better.  I actually believe this recently happened to PrimeDice in their latest upgrade, with something along the lines of the beta server was a fork of the production server and someone realized this and revealed their server seed and abused the crap out of it to the point it was super obvious. I also heard about another bitcoin site where someone social engineered their way into getting root credentials to the server, but was sufficiently unsophisticated he couldn't figure out how to withdraw the bitcoins.


That said, this is basically a nightmare situation for an investment site. Let's say they suspect or find out that the attacker actually had been abusing this before, who should be on the hook? The investors or the site? Kind of strange how no site ever clarifies that

Actually not a terrible idea, tell your friends to let you know when they want something on Amazon. Buy it for them, and get them to pay you in cash. Split the savings with them 50-50, or something

It's not an unreasonable fee, every transaction sent to the site directly costs them money, as eventually those inputs will need to be sent. And what makes it worse, is that most of the best have a low probability of winning, it makes it even more expensive for them to spend. Most other sites can eat that cost themselves because they have a house edge, and it's just a cost of doing business.  But it's not unreasonable for them to not want to run the site at a loss, so I think the fee is justified.

(But for instance, I'd had to ban accounts on my site that have made hundreds or thousands of deposits but never actually gamble, because they're just directly costing me money. A more natural thing would be to have a small deposit fee, but players would revolt against it because it's not standard)