Qt Bitcoin Trader [Open Source secure trading client for Mac/Windows/Linux]

[idee2013]

no advice for the issue/bug above? Had it in the recent days again

[1713560122]

1713560122

[IGHOR]

no advice for the issue/bug above? Had it in the recent days again

Hi. Currently I'm working on new rules engine and all bugs will be fixed soon.

[idee2013]

no advice for the issue/bug above? Had it in the recent days again

Hi. Currently I'm working on new rules engine and all bugs will be fixed soon.

ok, thank you very much. any time estimation?

[IGHOR]

ok, thank you very much. any time estimation?

I plan to release update within a week.

[vual]

Its been a long time any chance of this for another exchange yet like Bittrex or something?

[btcsup]

ok, thank you very much. any time estimation?

I plan to release update within a week.

This is great news.

[Askit2]

ok, thank you very much. any time estimation?

I plan to release update within a week.

This is great news.

Any news on the update?

I am looking forward to rules that make computer restarts less costly. Right now if I restart or when I restart I have to wait for the price to hit my last trade to restart my rules. It would be nice to actually have the bot start up and be able to have rules enabled not wait until the last set of variables line up again.

[IGHOR]

Any news on the update?

I am looking forward to rules that make computer restarts less costly. Right now if I restart or when I restart I have to wait for the price to hit my last trade to restart my rules. It would be nice to actually have the bot start up and be able to have rules enabled not wait until the last set of variables line up again.

I need a little more time to publish update.
You mean restore enabled/disabled state of each rule after restarting?

[Askit2]

Any news on the update?

I am looking forward to rules that make computer restarts less costly. Right now if I restart or when I restart I have to wait for the price to hit my last trade to restart my rules. It would be nice to actually have the bot start up and be able to have rules enabled not wait until the last set of variables line up again.

I need a little more time to publish update.
You mean restore enabled/disabled state of each rule after restarting?

I am not sure if it would make it into this update but we had discussed rules where the end user could set both sides of the logical equation. Like market ask price < (1%) last sell. A rule that used the last buy or sell but compared them to a value that actually is tradeable would fix the enabling issue.

As great as it would be to have the rules remember where they where as my logic stands it wouldn't entirely help me. Depending on downtime a rule coming back as enabled would help in some ways. I can't forget to enable them. It can also hurt in others for example if I want the last sell to trigger a buy rule and it does. Then I restart when it comes up and the rule is enabled again the price it will buy a percentage below would have likely moved some. If it moved up I have a loss. Of course if the market moved down I could have a larger gain.

What I meant by variables lining up is the basis for my buys or sells are a percentage above or below the last sell or buy respectively. If the price is above the last buy I can always enable a sell. If the price is below I can enable a sell as the pair for its trade already completed. If I have a sell and the buy price is above the last sell I shouldn't enable it. I do if the price is very close but I do so knowing I won't make as much of that specific trade. If the price is below the last sell I can always enable it but there is a risk the price doesn't fall enough to trigger the buy and a higher starting price would fix it.

To be honest I could always close out the trade manually to finish the pair then start one side or both and see what triggers first. I do sometimes do this to more rapidly get the bot back trading but some days it just won't pop high enough or drop low enough and I have to wait for a better price to try again.

[arorts]

Hello,

Any chance to add Coinsetter? It's a very professional platform run by real Wall Street people. Even better exchange engine than Bitstamp.

Here is their API link:

https://www.coinsetter.com/api/

We hope to see it soon (replacing MtGox)!!

Thanks!!!

[ZyTReX]

Any updates?

[ivanlabrie]

+1, was really interested in this project.
Give us an altcoin exchange MT4 platform and we'll love ya. :p
(btc-e's cool, but bittrex would rock)

[IGHOR]

Thanks everyone for your patience and anticipation of the new version.
I'm reading every message from you and next update will cover all required rules possibilities.
Very soon:

[Razick]

The UI is beautiful.

[capoeira]

any way to include Huobi (BitVC), OkCoin (.com)?

[IGHOR]

any way to include Huobi (BitVC), OkCoin (.com)?

I'm working to add them.

[IGHOR]

1.07.99 released!

Advanced script language with all JavaScript possibilities released.
Rules engine is completely rewrited.
Added Qt5 support.
Fixed a lot of ui and system bugs.
Added exchange https://goc.io
Fixed compilation bugs under Windows.
OpenSSL updated to latest 1.0.1i.

[capoeira]

any way to include Huobi (BitVC), OkCoin (.com)?

I'm working to add them.

very nice

[IGHOR]

A month ago I reported a bug within the Cryptsy API. They have acknowledge the bug and originally promised to implement a fix.

Cryptsy have still not implemented any fix and as such I think it is appropriate to make other community users aware of this.

Other Exchanges have appropriate API implementations which are protected by using hash and API Key values. Each packet is signed and is made unique by using a 'nonce value' - this is an incremental number. This is used to ensure the recieved packet is unique. This is to prevent potential replay attacks ie; reusing messages/packets sent to the API.

Duplicate / non-unique packets should be ignored/dropped by the API. What Crypsty allow is the ability for a malicious user to replay the same message to the API. This would require a malicious user to obtain a copy of your API Key and also the ability to packet capture from your local computer.

It is a relatively low risk attack vector but it's important that Cryptsy address a fix. We have seen other data leakage caused by bugs/vulnerabilities within OpenSSL which could contain sensitive data such as an API Key! If a malicious user was capable of exploiting this they would perform repeated actions using a replay attack.

Here is traffic log of account info requests. The same exact nonce used (14) and packets is exact the same.

Code:

------------------SENT - 2014-08-14 23:05:59

POST /api/ HTTP/1.1
Host: api.cryptsy.com
Accept-Encoding: gzip
Content-Type: application/x-www-form-urlencoded
Connection: keep-alive
Key: REST_KEY
Sign: 91994469c0a3c458ed0d5f570cc9d2e36544d90378ec5c4d59aeb5f7a592730829206ada44fdbfa54f2ea6a89538a7764fae08ff65182b0e867419e00f209dfc
Content-Length: 23

method=getinfo&nonce=14


------------------RECEIVED - 2014-08-14 23:06:00

{"success":"1","return":{"balances_available":{"42":"0.00000000","AGS":"0.00000000","ALN":"0.00000000","ALF":"0.00000000","AMC":"0.00000000","ADT":"0.00000000","ANC":"0.00000000","APEX":"0.00000000","ARG":"0.00000000","AC":"0.00000000","ASC":"0.00000000","AUR":"0.00000000","BAT":"0.00000000","BCX":"0.00000000","BQC":"0.00000000","BEN":"0.00000000","BET":"0.00000000","BTB":"0.00000000","BTC":"0.02000000","BTCD":"0.00000000","BTG":"0.00000000","PTS":"0.00000000","BC":"0.00000000","BLU":"0.00000000","CAP":"0.00000000","BTE":"0.00000000","CACH":"0.00000000","CAIx":"0.00000000","CASH":"0.00000000","CSC":"0.00000000","CAT":"0.00000000","CNC":"0.00000000","CINNI":"0.00000000","CLOAK":"0.00000000","COL":"0.00000000","COMM":"0.00000000","CNL":"0.00000000","CTM":"0.00000000","COOL":"0.00000000","CPR":"0.00000000","CLR":"0.00000000","CMC":"0.00000000","CRC":"0.00000000","CRYPT":"0.00000000","BUK":"0.00000000","CGB":"0.00000000","Points":"0.00000000","DMC":"0.00000000","DRKC":"0.00000000","DRK":"0.00000000","DVC":"0.00000000","DMD":"0.00000000","DGB":"0.00000000","DGC":"0.00000000","DIME":"0.00000000","DOGE":"0.00000000","DBL":"0.00000000","EAC":"0.00000000","EMC2":"0.00000000","ELC":"0.00000000","ELP":"0.00000000","DEM":"0.00000000","EMD":"0.00000000","EXE":"0.00000000","EZC":"0.00000000","FST":"0.00000000","FTC":"0.00000000","TIPS":"0.00000000","FFC":"0.00000000","FLAP":"0.00000000","FLO":"0.00000000","FLT":"0.00000000","FRAC":"0.00000000","FRK":"0.00000000","FRC":"0.00000000","GLX":"0.00000000","GME":"0.00000000","GLC":"0.00000000","GLYPH":"0.00000000","GLD":"0.00000000","GDC":"0.00000000","GUE":"0.00000000","HVC":"0.00000000","HBN":"0.00000000","HUC":"0.00000000","HYC":"0.00000000","IOC":"0.00000000","ICB":"0.00000000","IFC":"0.00000000","IXC":"0.00000000","XJO":"0.00000000","JUDGE":"0.00000000","JKC":"0.00000000","KARM":"0.00000000","KEY":"0.00000000","MEOW":"0.00000000","KDC":"0.00000000","KGC":"0.00000000","LEAF":"0.00000000","LGD":"0.00000000","XLB":"0.00000000","LTB":"0.00000000","LTC":"0.00000000","LTCX":"0.00000000","LOT":"0.00000000","LK7":"0.00000000","LKY":"0.00000000","LYC":"0.00000000","MST":"0.00000000","MAX":"0.00000000","MZC":"0.00000000","MEC":"0.00000000","MEM":"0.00000000","MNC":"0.00000000","MIN":"0.00000000","MN1":"0.00000000","MN2":"0.00000000","MINT":"0.00000000","MOON":"0.00000000","MRY":"0.00000000","MYR":"0.00000000","NMC":"0.00000000","NAN":"0.00000000","NAUT":"0.00000000","NAV":"0.00000000","NEC":"0.00000000","NET":"0.00000000","NBL":"0.00000000","NOBL":"0.00000000","NRB":"0.00000000","NRS":"0.00000000","NVC":"0.00000000","NXT":"0.00000000","NYAN":"0.00000000","OSC":"0.00000000","ORB":"0.00000000","PYC":"0.00000000","PPC":"0.00000000","CENT":"0.00000000","PHS":"0.00000000","PXC":"0.00000000","POT":"0.00000000","XPM":"0.00000000","PSEUD":"0.00000000","QRK":"0.00000000","RBBT":"0.00000000","RZR":"0.00000000","RED":"0.00000000","RDD":"0.00000000","RPC":"0.00000000","RT2":"0.00000000","RYC":"0.00000000","SFR":"0.00000000","SAT2":"0.00000000","SRC":"0.00000000","SXC":"0.00000000","SHLD":"0.00000000","SC":"0.00000000","SMC":"0.00000000","SPA":"0.00000000","SPT":"0.00000000","SBC":"0.00000000","STR":"0.00000000","SUPER":"0.00000000","SYNC":"0.00000000","TAG":"0.00000000","TAK":"0.00000000","TEK":"0.00000000","TRC":"0.00000000","TES":"0.00000000","TIX":"0.00000000","TGC":"0.00000000","TOR":"0.00000000","UTC":"0.00000000","UNB":"0.00000000","UNO":"0.00000000","URO":"0.00000000","USD":"0.00000000","USDe":"0.00000000","VRC":"0.00000000","VTC":"0.00000000","VIA":"0.00000000","VOOT":"0.00000000","WC":"0.00000000","WDC":"0.00000000","XC":"0.00000000","XNC":"0.00000000","XXX":"0.00000000","YAC":"0.00000000","YBC":"0.00000000","ZCC":"0.00000000","ZED":"0.00000000","ZEIT":"0.00000000","ZET":"0.00000000"},"balances_available_btc":{"42":"0.00000000","AGS":"0.00000000","ALN":"0.00000000","ALF":"0.00000000","AMC":"0.00000000","ADT":"0.00000000","ANC":"0.00000000","APEX":"0.00000000","ARG":"0.00000000","AC":"0.00000000","ASC":"0.00000000","AUR":"0.00000000","BAT":"0.00000000","BCX":"0.00000000","BQC":"0.00000000","BEN":"0.00000000","BET":"0.00000000","BTB":"0.00000000","BTC":"0.02000000","BTCD":"0.00000000","BTG":"0.00000000","PTS":"0.00000000","BC":"0.00000000","BLU":"0.00000000","CAP":"0.00000000","BTE":"0.00000000","CACH":"0.00000000","CAIx":"0.00000000","CASH":"0.00000000","CSC":"0.00000000","CAT":"0.00000000","CNC":"0.00000000","CINNI":"0.00000000","CLOAK":"0.00000000","COL":"0.00000000","COMM":"0.00000000","CNL":"0.00000000","CTM":"0.00000000","COOL":"0.00000000","CPR":"0.00000000","CLR":"0.00000000","CMC":"0.00000000","CRC":"0.00000000","CRYPT":"0.00000000","BUK":"0.00000000","CGB":"0.00000000","Points":"0.00000000","DMC":"0.00000000","DRKC":"0.00000000","DRK":"0.00000000","DVC":"0.00000000","DMD":"0.00000000","DGB":"0.00000000","DGC":"0.00000000","DIME":"0.00000000","DOGE":"0.00000000","DBL":"0.00000000","EAC":"0.00000000","EMC2":"0.00000000","ELC":"0.00000000","ELP":"0.00000000","DEM":"0.00000000","EMD":"0.00000000","EXE":"0.00000000","EZC":"0.00000000","FST":"0.00000000","FTC":"0.00000000","TIPS":"0.00000000","FFC":"0.00000000","FLAP":"0.00000000","FLO":"0.00000000","FLT":"0.00000000","FRAC":"0.00000000","FRK":"0.00000000","FRC":"0.00000000","GLX":"0.00000000","GME":"0.00000000","GLC":"0.00000000","GLYPH":"0.00000000","GLD":"0.00000000","GDC":"0.00000000","GUE":"0.00000000","HVC":"0.00000000","HBN":"0.00000000","HUC":"0.00000000","HYC":"0.00000000","IOC":"0.00000000","ICB":"0.00000000","IFC":"0.00000000","IXC":"0.00000000","XJO":"0.00000000","JUDGE":"0.00000000","JKC":"0.00000000","KARM":"0.00000000","KEY":"0.00000000","MEOW":"0.00000000","KDC":"0.00000000","KGC":"0.00000000","LEAF":"0.00000000","LGD":"0.00000000","XLB":"0.00000000","LTB":"0.00000000","LTC":"0.00000000","LTCX":"0.00000000","LOT":"0.00000000","LK7":"0.00000000","LKY":"0.00000000","LYC":"0.00000000","MST":"0.00000000","MAX":"0.00000000","MZC":"0.00000000","MEC":"0.00000000","MEM":"0.00000000","MNC":"0.00000000","MIN":"0.00000000","MN1":"0.00000000","MN2":"0.00000000","MINT":"0.00000000","MOON":"0.00000000","MRY":"0.00000000","MYR":"0.00000000","NMC":"0.00000000","NAN":"0.00000000","NAUT":"0.00000000","NAV":"0.00000000","NEC":"0.00000000","NET":"0.00000000","NBL":"0.00000000","NOBL":"0.00000000","NRB":"0.00000000","NRS":"0.00000000","NVC":"0.00000000","NXT":"0.00000000","NYAN":"0.00000000","OSC":"0.00000000","ORB":"0.00000000","PYC":"0.00000000","PPC":"0.00000000","CENT":"0.00000000","PHS":"0.00000000","PXC":"0.00000000","POT":"0.00000000","XPM":"0.00000000","PSEUD":"0.00000000","QRK":"0.00000000","RBBT":"0.00000000","RZR":"0.00000000","RED":"0.00000000","RDD":"0.00000000","RPC":"0.00000000","RT2":"0.00000000","RYC":"0.00000000","SFR":"0.00000000","SAT2":"0.00000000","SRC":"0.00000000","SXC":"0.00000000","SHLD":"0.00000000","SC":"0.00000000","SMC":"0.00000000","SPA":"0.00000000","SPT":"0.00000000","SBC":"0.00000000","STR":"0.00000000","SUPER":"0.00000000","SYNC":"0.00000000","TAG":"0.00000000","TAK":"0.00000000","TEK":"0.00000000","TRC":"0.00000000","TES":"0.00000000","TIX":"0.00000000","TGC":"0.00000000","TOR":"0.00000000","UTC":"0.00000000","UNB":"0.00000000","UNO":"0.00000000","URO":"0.00000000","USD":"0.00000000","USDe":"0.00000000","VRC":"0.00000000","VTC":"0.00000000","VIA":"0.00000000","VOOT":"0.00000000","WC":"0.00000000","WDC":"0.00000000","XC":"0.00000000","XNC":"0.00000000","XXX":"0.00000000","YAC":"0.00000000","YBC":"0.00000000","ZCC":"0.00000000","ZED":"0.00000000","ZEIT":"0.00000000","ZET":"0.00000000"},"servertimestamp":1408046748,"servertimezone":"EST","serverdatetime":"2014-08-14 16:05:48","openordercount":0}}


--------------------SENT - 2014-08-14 23:06:09

POST /api/ HTTP/1.1
Host: api.cryptsy.com
Accept-Encoding: gzip
Content-Type: application/x-www-form-urlencoded
Connection: keep-alive
Key: REST_KEY
Sign: 91994469c0a3c458ed0d5f570cc9d2e36544d90378ec5c4d59aeb5f7a592730829206ada44fdbfa54f2ea6a89538a7764fae08ff65182b0e867419e00f209dfc
Content-Length: 23

method=getinfo&nonce=14


--------------------RECEIVED - 2014-08-14 23:06:10

{"success":"1","return":{"balances_available":{"42":"0.00000000","AGS":"0.00000000","ALN":"0.00000000","ALF":"0.00000000","AMC":"0.00000000","ADT":"0.00000000","ANC":"0.00000000","APEX":"0.00000000","ARG":"0.00000000","AC":"0.00000000","ASC":"0.00000000","AUR":"0.00000000","BAT":"0.00000000","BCX":"0.00000000","BQC":"0.00000000","BEN":"0.00000000","BET":"0.00000000","BTB":"0.00000000","BTC":"0.02000000","BTCD":"0.00000000","BTG":"0.00000000","PTS":"0.00000000","BC":"0.00000000","BLU":"0.00000000","CAP":"0.00000000","BTE":"0.00000000","CACH":"0.00000000","CAIx":"0.00000000","CASH":"0.00000000","CSC":"0.00000000","CAT":"0.00000000","CNC":"0.00000000","CINNI":"0.00000000","CLOAK":"0.00000000","COL":"0.00000000","COMM":"0.00000000","CNL":"0.00000000","CTM":"0.00000000","COOL":"0.00000000","CPR":"0.00000000","CLR":"0.00000000","CMC":"0.00000000","CRC":"0.00000000","CRYPT":"0.00000000","BUK":"0.00000000","CGB":"0.00000000","Points":"0.00000000","DMC":"0.00000000","DRKC":"0.00000000","DRK":"0.00000000","DVC":"0.00000000","DMD":"0.00000000","DGB":"0.00000000","DGC":"0.00000000","DIME":"0.00000000","DOGE":"0.00000000","DBL":"0.00000000","EAC":"0.00000000","EMC2":"0.00000000","ELC":"0.00000000","ELP":"0.00000000","DEM":"0.00000000","EMD":"0.00000000","EXE":"0.00000000","EZC":"0.00000000","FST":"0.00000000","FTC":"0.00000000","TIPS":"0.00000000","FFC":"0.00000000","FLAP":"0.00000000","FLO":"0.00000000","FLT":"0.00000000","FRAC":"0.00000000","FRK":"0.00000000","FRC":"0.00000000","GLX":"0.00000000","GME":"0.00000000","GLC":"0.00000000","GLYPH":"0.00000000","GLD":"0.00000000","GDC":"0.00000000","GUE":"0.00000000","HVC":"0.00000000","HBN":"0.00000000","HUC":"0.00000000","HYC":"0.00000000","IOC":"0.00000000","ICB":"0.00000000","IFC":"0.00000000","IXC":"0.00000000","XJO":"0.00000000","JUDGE":"0.00000000","JKC":"0.00000000","KARM":"0.00000000","KEY":"0.00000000","MEOW":"0.00000000","KDC":"0.00000000","KGC":"0.00000000","LEAF":"0.00000000","LGD":"0.00000000","XLB":"0.00000000","LTB":"0.00000000","LTC":"0.00000000","LTCX":"0.00000000","LOT":"0.00000000","LK7":"0.00000000","LKY":"0.00000000","LYC":"0.00000000","MST":"0.00000000","MAX":"0.00000000","MZC":"0.00000000","MEC":"0.00000000","MEM":"0.00000000","MNC":"0.00000000","MIN":"0.00000000","MN1":"0.00000000","MN2":"0.00000000","MINT":"0.00000000","MOON":"0.00000000","MRY":"0.00000000","MYR":"0.00000000","NMC":"0.00000000","NAN":"0.00000000","NAUT":"0.00000000","NAV":"0.00000000","NEC":"0.00000000","NET":"0.00000000","NBL":"0.00000000","NOBL":"0.00000000","NRB":"0.00000000","NRS":"0.00000000","NVC":"0.00000000","NXT":"0.00000000","NYAN":"0.00000000","OSC":"0.00000000","ORB":"0.00000000","PYC":"0.00000000","PPC":"0.00000000","CENT":"0.00000000","PHS":"0.00000000","PXC":"0.00000000","POT":"0.00000000","XPM":"0.00000000","PSEUD":"0.00000000","QRK":"0.00000000","RBBT":"0.00000000","RZR":"0.00000000","RED":"0.00000000","RDD":"0.00000000","RPC":"0.00000000","RT2":"0.00000000","RYC":"0.00000000","SFR":"0.00000000","SAT2":"0.00000000","SRC":"0.00000000","SXC":"0.00000000","SHLD":"0.00000000","SC":"0.00000000","SMC":"0.00000000","SPA":"0.00000000","SPT":"0.00000000","SBC":"0.00000000","STR":"0.00000000","SUPER":"0.00000000","SYNC":"0.00000000","TAG":"0.00000000","TAK":"0.00000000","TEK":"0.00000000","TRC":"0.00000000","TES":"0.00000000","TIX":"0.00000000","TGC":"0.00000000","TOR":"0.00000000","UTC":"0.00000000","UNB":"0.00000000","UNO":"0.00000000","URO":"0.00000000","USD":"0.00000000","USDe":"0.00000000","VRC":"0.00000000","VTC":"0.00000000","VIA":"0.00000000","VOOT":"0.00000000","WC":"0.00000000","WDC":"0.00000000","XC":"0.00000000","XNC":"0.00000000","XXX":"0.00000000","YAC":"0.00000000","YBC":"0.00000000","ZCC":"0.00000000","ZED":"0.00000000","ZEIT":"0.00000000","ZET":"0.00000000"},"balances_available_btc":{"42":"0.00000000","AGS":"0.00000000","ALN":"0.00000000","ALF":"0.00000000","AMC":"0.00000000","ADT":"0.00000000","ANC":"0.00000000","APEX":"0.00000000","ARG":"0.00000000","AC":"0.00000000","ASC":"0.00000000","AUR":"0.00000000","BAT":"0.00000000","BCX":"0.00000000","BQC":"0.00000000","BEN":"0.00000000","BET":"0.00000000","BTB":"0.00000000","BTC":"0.02000000","BTCD":"0.00000000","BTG":"0.00000000","PTS":"0.00000000","BC":"0.00000000","BLU":"0.00000000","CAP":"0.00000000","BTE":"0.00000000","CACH":"0.00000000","CAIx":"0.00000000","CASH":"0.00000000","CSC":"0.00000000","CAT":"0.00000000","CNC":"0.00000000","CINNI":"0.00000000","CLOAK":"0.00000000","COL":"0.00000000","COMM":"0.00000000","CNL":"0.00000000","CTM":"0.00000000","COOL":"0.00000000","CPR":"0.00000000","CLR":"0.00000000","CMC":"0.00000000","CRC":"0.00000000","CRYPT":"0.00000000","BUK":"0.00000000","CGB":"0.00000000","Points":"0.00000000","DMC":"0.00000000","DRKC":"0.00000000","DRK":"0.00000000","DVC":"0.00000000","DMD":"0.00000000","DGB":"0.00000000","DGC":"0.00000000","DIME":"0.00000000","DOGE":"0.00000000","DBL":"0.00000000","EAC":"0.00000000","EMC2":"0.00000000","ELC":"0.00000000","ELP":"0.00000000","DEM":"0.00000000","EMD":"0.00000000","EXE":"0.00000000","EZC":"0.00000000","FST":"0.00000000","FTC":"0.00000000","TIPS":"0.00000000","FFC":"0.00000000","FLAP":"0.00000000","FLO":"0.00000000","FLT":"0.00000000","FRAC":"0.00000000","FRK":"0.00000000","FRC":"0.00000000","GLX":"0.00000000","GME":"0.00000000","GLC":"0.00000000","GLYPH":"0.00000000","GLD":"0.00000000","GDC":"0.00000000","GUE":"0.00000000","HVC":"0.00000000","HBN":"0.00000000","HUC":"0.00000000","HYC":"0.00000000","IOC":"0.00000000","ICB":"0.00000000","IFC":"0.00000000","IXC":"0.00000000","XJO":"0.00000000","JUDGE":"0.00000000","JKC":"0.00000000","KARM":"0.00000000","KEY":"0.00000000","MEOW":"0.00000000","KDC":"0.00000000","KGC":"0.00000000","LEAF":"0.00000000","LGD":"0.00000000","XLB":"0.00000000","LTB":"0.00000000","LTC":"0.00000000","LTCX":"0.00000000","LOT":"0.00000000","LK7":"0.00000000","LKY":"0.00000000","LYC":"0.00000000","MST":"0.00000000","MAX":"0.00000000","MZC":"0.00000000","MEC":"0.00000000","MEM":"0.00000000","MNC":"0.00000000","MIN":"0.00000000","MN1":"0.00000000","MN2":"0.00000000","MINT":"0.00000000","MOON":"0.00000000","MRY":"0.00000000","MYR":"0.00000000","NMC":"0.00000000","NAN":"0.00000000","NAUT":"0.00000000","NAV":"0.00000000","NEC":"0.00000000","NET":"0.00000000","NBL":"0.00000000","NOBL":"0.00000000","NRB":"0.00000000","NRS":"0.00000000","NVC":"0.00000000","NXT":"0.00000000","NYAN":"0.00000000","OSC":"0.00000000","ORB":"0.00000000","PYC":"0.00000000","PPC":"0.00000000","CENT":"0.00000000","PHS":"0.00000000","PXC":"0.00000000","POT":"0.00000000","XPM":"0.00000000","PSEUD":"0.00000000","QRK":"0.00000000","RBBT":"0.00000000","RZR":"0.00000000","RED":"0.00000000","RDD":"0.00000000","RPC":"0.00000000","RT2":"0.00000000","RYC":"0.00000000","SFR":"0.00000000","SAT2":"0.00000000","SRC":"0.00000000","SXC":"0.00000000","SHLD":"0.00000000","SC":"0.00000000","SMC":"0.00000000","SPA":"0.00000000","SPT":"0.00000000","SBC":"0.00000000","STR":"0.00000000","SUPER":"0.00000000","SYNC":"0.00000000","TAG":"0.00000000","TAK":"0.00000000","TEK":"0.00000000","TRC":"0.00000000","TES":"0.00000000","TIX":"0.00000000","TGC":"0.00000000","TOR":"0.00000000","UTC":"0.00000000","UNB":"0.00000000","UNO":"0.00000000","URO":"0.00000000","USD":"0.00000000","USDe":"0.00000000","VRC":"0.00000000","VTC":"0.00000000","VIA":"0.00000000","VOOT":"0.00000000","WC":"0.00000000","WDC":"0.00000000","XC":"0.00000000","XNC":"0.00000000","XXX":"0.00000000","YAC":"0.00000000","YBC":"0.00000000","ZCC":"0.00000000","ZED":"0.00000000","ZEIT":"0.00000000","ZET":"0.00000000"},"servertimestamp":1408046758,"servertimezone":"EST","serverdatetime":"2014-08-14 16:05:58","openordercount":0}}


--------------------SENT - 2014-08-14 23:06:19

POST /api/ HTTP/1.1
Host: api.cryptsy.com
Accept-Encoding: gzip
Content-Type: application/x-www-form-urlencoded
Connection: keep-alive
Key: REST_KEY
Sign: 91994469c0a3c458ed0d5f570cc9d2e36544d90378ec5c4d59aeb5f7a592730829206ada44fdbfa54f2ea6a89538a7764fae08ff65182b0e867419e00f209dfc
Content-Length: 23

method=getinfo&nonce=14


--------------------RECEIVED - 2014-08-14 23:06:20

{"success":"1","return":{"balances_available":{"42":"0.00000000","AGS":"0.00000000","ALN":"0.00000000","ALF":"0.00000000","AMC":"0.00000000","ADT":"0.00000000","ANC":"0.00000000","APEX":"0.00000000","ARG":"0.00000000","AC":"0.00000000","ASC":"0.00000000","AUR":"0.00000000","BAT":"0.00000000","BCX":"0.00000000","BQC":"0.00000000","BEN":"0.00000000","BET":"0.00000000","BTB":"0.00000000","BTC":"0.02000000","BTCD":"0.00000000","BTG":"0.00000000","PTS":"0.00000000","BC":"0.00000000","BLU":"0.00000000","CAP":"0.00000000","BTE":"0.00000000","CACH":"0.00000000","CAIx":"0.00000000","CASH":"0.00000000","CSC":"0.00000000","CAT":"0.00000000","CNC":"0.00000000","CINNI":"0.00000000","CLOAK":"0.00000000","COL":"0.00000000","COMM":"0.00000000","CNL":"0.00000000","CTM":"0.00000000","COOL":"0.00000000","CPR":"0.00000000","CLR":"0.00000000","CMC":"0.00000000","CRC":"0.00000000","CRYPT":"0.00000000","BUK":"0.00000000","CGB":"0.00000000","Points":"0.00000000","DMC":"0.00000000","DRKC":"0.00000000","DRK":"0.00000000","DVC":"0.00000000","DMD":"0.00000000","DGB":"0.00000000","DGC":"0.00000000","DIME":"0.00000000","DOGE":"0.00000000","DBL":"0.00000000","EAC":"0.00000000","EMC2":"0.00000000","ELC":"0.00000000","ELP":"0.00000000","DEM":"0.00000000","EMD":"0.00000000","EXE":"0.00000000","EZC":"0.00000000","FST":"0.00000000","FTC":"0.00000000","TIPS":"0.00000000","FFC":"0.00000000","FLAP":"0.00000000","FLO":"0.00000000","FLT":"0.00000000","FRAC":"0.00000000","FRK":"0.00000000","FRC":"0.00000000","GLX":"0.00000000","GME":"0.00000000","GLC":"0.00000000","GLYPH":"0.00000000","GLD":"0.00000000","GDC":"0.00000000","GUE":"0.00000000","HVC":"0.00000000","HBN":"0.00000000","HUC":"0.00000000","HYC":"0.00000000","IOC":"0.00000000","ICB":"0.00000000","IFC":"0.00000000","IXC":"0.00000000","XJO":"0.00000000","JUDGE":"0.00000000","JKC":"0.00000000","KARM":"0.00000000","KEY":"0.00000000","MEOW":"0.00000000","KDC":"0.00000000","KGC":"0.00000000","LEAF":"0.00000000","LGD":"0.00000000","XLB":"0.00000000","LTB":"0.00000000","LTC":"0.00000000","LTCX":"0.00000000","LOT":"0.00000000","LK7":"0.00000000","LKY":"0.00000000","LYC":"0.00000000","MST":"0.00000000","MAX":"0.00000000","MZC":"0.00000000","MEC":"0.00000000","MEM":"0.00000000","MNC":"0.00000000","MIN":"0.00000000","MN1":"0.00000000","MN2":"0.00000000","MINT":"0.00000000","MOON":"0.00000000","MRY":"0.00000000","MYR":"0.00000000","NMC":"0.00000000","NAN":"0.00000000","NAUT":"0.00000000","NAV":"0.00000000","NEC":"0.00000000","NET":"0.00000000","NBL":"0.00000000","NOBL":"0.00000000","NRB":"0.00000000","NRS":"0.00000000","NVC":"0.00000000","NXT":"0.00000000","NYAN":"0.00000000","OSC":"0.00000000","ORB":"0.00000000","PYC":"0.00000000","PPC":"0.00000000","CENT":"0.00000000","PHS":"0.00000000","PXC":"0.00000000","POT":"0.00000000","XPM":"0.00000000","PSEUD":"0.00000000","QRK":"0.00000000","RBBT":"0.00000000","RZR":"0.00000000","RED":"0.00000000","RDD":"0.00000000","RPC":"0.00000000","RT2":"0.00000000","RYC":"0.00000000","SFR":"0.00000000","SAT2":"0.00000000","SRC":"0.00000000","SXC":"0.00000000","SHLD":"0.00000000","SC":"0.00000000","SMC":"0.00000000","SPA":"0.00000000","SPT":"0.00000000","SBC":"0.00000000","STR":"0.00000000","SUPER":"0.00000000","SYNC":"0.00000000","TAG":"0.00000000","TAK":"0.00000000","TEK":"0.00000000","TRC":"0.00000000","TES":"0.00000000","TIX":"0.00000000","TGC":"0.00000000","TOR":"0.00000000","UTC":"0.00000000","UNB":"0.00000000","UNO":"0.00000000","URO":"0.00000000","USD":"0.00000000","USDe":"0.00000000","VRC":"0.00000000","VTC":"0.00000000","VIA":"0.00000000","VOOT":"0.00000000","WC":"0.00000000","WDC":"0.00000000","XC":"0.00000000","XNC":"0.00000000","XXX":"0.00000000","YAC":"0.00000000","YBC":"0.00000000","ZCC":"0.00000000","ZED":"0.00000000","ZEIT":"0.00000000","ZET":"0.00000000"},"balances_available_btc":{"42":"0.00000000","AGS":"0.00000000","ALN":"0.00000000","ALF":"0.00000000","AMC":"0.00000000","ADT":"0.00000000","ANC":"0.00000000","APEX":"0.00000000","ARG":"0.00000000","AC":"0.00000000","ASC":"0.00000000","AUR":"0.00000000","BAT":"0.00000000","BCX":"0.00000000","BQC":"0.00000000","BEN":"0.00000000","BET":"0.00000000","BTB":"0.00000000","BTC":"0.02000000","BTCD":"0.00000000","BTG":"0.00000000","PTS":"0.00000000","BC":"0.00000000","BLU":"0.00000000","CAP":"0.00000000","BTE":"0.00000000","CACH":"0.00000000","CAIx":"0.00000000","CASH":"0.00000000","CSC":"0.00000000","CAT":"0.00000000","CNC":"0.00000000","CINNI":"0.00000000","CLOAK":"0.00000000","COL":"0.00000000","COMM":"0.00000000","CNL":"0.00000000","CTM":"0.00000000","COOL":"0.00000000","CPR":"0.00000000","CLR":"0.00000000","CMC":"0.00000000","CRC":"0.00000000","CRYPT":"0.00000000","BUK":"0.00000000","CGB":"0.00000000","Points":"0.00000000","DMC":"0.00000000","DRKC":"0.00000000","DRK":"0.00000000","DVC":"0.00000000","DMD":"0.00000000","DGB":"0.00000000","DGC":"0.00000000","DIME":"0.00000000","DOGE":"0.00000000","DBL":"0.00000000","EAC":"0.00000000","EMC2":"0.00000000","ELC":"0.00000000","ELP":"0.00000000","DEM":"0.00000000","EMD":"0.00000000","EXE":"0.00000000","EZC":"0.00000000","FST":"0.00000000","FTC":"0.00000000","TIPS":"0.00000000","FFC":"0.00000000","FLAP":"0.00000000","FLO":"0.00000000","FLT":"0.00000000","FRAC":"0.00000000","FRK":"0.00000000","FRC":"0.00000000","GLX":"0.00000000","GME":"0.00000000","GLC":"0.00000000","GLYPH":"0.00000000","GLD":"0.00000000","GDC":"0.00000000","GUE":"0.00000000","HVC":"0.00000000","HBN":"0.00000000","HUC":"0.00000000","HYC":"0.00000000","IOC":"0.00000000","ICB":"0.00000000","IFC":"0.00000000","IXC":"0.00000000","XJO":"0.00000000","JUDGE":"0.00000000","JKC":"0.00000000","KARM":"0.00000000","KEY":"0.00000000","MEOW":"0.00000000","KDC":"0.00000000","KGC":"0.00000000","LEAF":"0.00000000","LGD":"0.00000000","XLB":"0.00000000","LTB":"0.00000000","LTC":"0.00000000","LTCX":"0.00000000","LOT":"0.00000000","LK7":"0.00000000","LKY":"0.00000000","LYC":"0.00000000","MST":"0.00000000","MAX":"0.00000000","MZC":"0.00000000","MEC":"0.00000000","MEM":"0.00000000","MNC":"0.00000000","MIN":"0.00000000","MN1":"0.00000000","MN2":"0.00000000","MINT":"0.00000000","MOON":"0.00000000","MRY":"0.00000000","MYR":"0.00000000","NMC":"0.00000000","NAN":"0.00000000","NAUT":"0.00000000","NAV":"0.00000000","NEC":"0.00000000","NET":"0.00000000","NBL":"0.00000000","NOBL":"0.00000000","NRB":"0.00000000","NRS":"0.00000000","NVC":"0.00000000","NXT":"0.00000000","NYAN":"0.00000000","OSC":"0.00000000","ORB":"0.00000000","PYC":"0.00000000","PPC":"0.00000000","CENT":"0.00000000","PHS":"0.00000000","PXC":"0.00000000","POT":"0.00000000","XPM":"0.00000000","PSEUD":"0.00000000","QRK":"0.00000000","RBBT":"0.00000000","RZR":"0.00000000","RED":"0.00000000","RDD":"0.00000000","RPC":"0.00000000","RT2":"0.00000000","RYC":"0.00000000","SFR":"0.00000000","SAT2":"0.00000000","SRC":"0.00000000","SXC":"0.00000000","SHLD":"0.00000000","SC":"0.00000000","SMC":"0.00000000","SPA":"0.00000000","SPT":"0.00000000","SBC":"0.00000000","STR":"0.00000000","SUPER":"0.00000000","SYNC":"0.00000000","TAG":"0.00000000","TAK":"0.00000000","TEK":"0.00000000","TRC":"0.00000000","TES":"0.00000000","TIX":"0.00000000","TGC":"0.00000000","TOR":"0.00000000","UTC":"0.00000000","UNB":"0.00000000","UNO":"0.00000000","URO":"0.00000000","USD":"0.00000000","USDe":"0.00000000","VRC":"0.00000000","VTC":"0.00000000","VIA":"0.00000000","VOOT":"0.00000000","WC":"0.00000000","WDC":"0.00000000","XC":"0.00000000","XNC":"0.00000000","XXX":"0.00000000","YAC":"0.00000000","YBC":"0.00000000","ZCC":"0.00000000","ZED":"0.00000000","ZEIT":"0.00000000","ZET":"0.00000000"},"servertimestamp":1408046768,"servertimezone":"EST","serverdatetime":"2014-08-14 16:06:08","openordercount":0}}

[m0gliE]

A month ago I reported a bug within the Cryptsy API. They have acknowledge the bug and originally promised to implement a fix.

Cryptsy have still not implemented any fix and as such I think it is appropriate to make other community users aware of this.

Other Exchanges have appropriate API implementations which are protected by using hash and API Key values. Each packet is signed and is made unique by using a 'nonce value' - this is an incremental number. This is used to ensure the recieved packet is unique. This is to prevent potential replay attacks ie; reusing messages/packets sent to the API.

Duplicate / non-unique packets should be ignored/dropped by the API. What Crypsty allow is the ability for a malicious user to replay the same message to the API. This would require a malicious user to obtain a copy of your API Key and also the ability to packet capture from your local computer.

It is a relatively low risk attack vector but it's important that Cryptsy address a fix. We have seen other data leakage caused by bugs/vulnerabilities within OpenSSL which could contain sensitive data such as an API Key! If a malicious user was capable of exploiting this they would perform repeated actions using a replay attack.

Cryptsy really should have built in some sort of mechanism that would prevent any type of replay attacks. An avoidance as simple as something like expiring tokens, hases values, or anything that invalidates after each process is finished. This would also work with HTTP and not just HTTPS which it's not even using.

I'm glad you made this post IGHOR, like I said earlier, somebody over at cryptsy needs a swift kick in the ass.