Vulnerability in mmcFE Manual Withdrawal Logic

[the1silverwolf]

To: Any pool operator using mmcFE or any one of a dozen derivative forks.

A vulnerability has been discovered in the Manual Withdrawal logic that can allow Withdrawals to be duplicated.

The vulnerability is in accountdetails.php.

Essentially firing off several withdrawal requests in less than a second can sometimes allow multiple withdrawals to be processed.

Resulting in duplicate payments being sent before the first one completes and the users account balance is set to 0.

You should disable manual withdrawal until you can code a work around.

Details here : https://bitcointalk.org/index.php?topic=228419.msg2416246#msg2416246

Moderator : you might want to make this thread a sticky as there are tons of pools based upon this code.

[John (John K.)]

Stickied for the time being.

[NetcodePool]

Check your ledger for debit_atp.   You may find double payments there as well.

[bernard75]

Wow, thats some serious shit.

[fcmatt]

Here is a quick fix that i posted in this thread.
one might want to clean it up a bit so you do not reuse variable names but it does work fine.

https://bitcointalk.org/index.php?topic=239207.msg2533156#msg2533156

[John (John K.)]

I guess it should be pretty much seen and solved by all pool OP's by now. Unstickied for the time being.