**Error found on Bitbook.biz (images included/proof)**

[BayAreaCoins]

This morning I stumbled across a error in Bitbook.biz that allows BTC to be transferred out while a bet is pending.

Basically what I did was I placed the following bet:



Looks like I lost correct? No, I found that BTC can bet transferred between BitBook.biz accounts even while the bet is pending! So once I saw that my one pick lost I transferred the BTC to a friends account who is also on Bitbook.biz. (My friends account has been blacked out due to privacy, but Bitbooks.biz has been made aware of all accounts associated via PM.)

 

From this account I simply sent the 4BTC out of the Bitbook.biz website and it was as if I never placed the bet

Blockchain info: https://blockchain.info/address/17kceCdAeEiQ2fgZz5nxjzhoi9TdhjgSGs

After discovering this error I decided to test the system to see if I was about to place bets on account and then send the BTC out of the system, but still get paid. I wanted to cover my butt in case the accounts were frozen so I informed a trusted member here on the Bitcointalk.org website of what I was doing so if my funds were frozen Bitbook would refund my funds frozen into the accounts.

I sent a additional 15BTC+the 4BTC from my error into Bitbooks.biz for testing.
https://blockchain.info/address/15dBLXY5v1bDF5KN37x47K4RaiPsoVoUbu
(Later I sent a addition .1BTC for testing withdraw.)
https://blockchain.info/address/1L8XoWuf35GinnnBTAYPEJaN1xfZhpVDH5

I then started the accounts bet2win-bet2win1-bet2win2-bet2win3-bet2win4-bet2win5-bet2win6-bet2win7-bet2win8 and bet2win9. With these accounts I was able to place my pending bets and then use the same transfer option to fund the other accounts.
 
This is what the accounts look like on all 10 accounts:



Once I had placed all the bets I sent the 19.1BTC to the account "Wallet2Win" to be transferred out.

At this point Bitbook.biz froze all the accounts with the 0 balance/19 pending, including the Wallet2win funds to be transferred out. I never had the intentions of ever stealing any of the fund that were frozen, I was simply checking the system.

I am asking Bitbooks.biz to please refund my 15.1BTC (4BTC of that was lost due to losing that Parley bet. When I make my bets, I pay my bets.) Any bounty that can be tipped to me for showing this error would be greatly appreciated.  I have no concerns about getting my BTC back because I honestly believe Bitbooks.biz are ran by stand up people. (And I have already lost 20BTC in bets there between my group of friends)

Below is my COVER my Butt policy:

This is a series of e-mails I exchanged for "information" escrow to the owner of Satoshibet.com (stand up guy, I won .443BTC into over 20 and was paid.)

Re: Great site!!!!!
« Sent to: addi on: Today at 01:27:49 PM »
Quote  Reply  Delete  
Yes thank you.  Would you mind if I use you as escrow for information I just found out so it doesn't look like I am trying to steal BTC from a error I just found on a website?

I don't want them to keep my 19BTC (it is in the process of being sent out of their accounts) because they though I was trying to rip them off, I am going to alert the site owner once I see that the site actually has a flaw?

Just worried they may have to manually approve the 19BTC (which they very well may not) and they will think I am trying to steal.

I am going to ask them for a good size bounty of course because it is a major error.
_____________________________________________________
Re: Great site!!!!!
« Sent to: BayAreaCoins on: Today at 01:34:17 PM »
« You have forwarded or responded to this message. »
Quote  Reply  Delete  
Is it a bitcoin gambling site? What's the flaw?
_____________________________________________________
Re: Great site!!!!!
« Sent to: addi on: Today at 01:41:17 PM »
Quote  Reply  Delete  
Yes it is a gambling website, you have to swear you will not exploit it. I want to tell someone so I am not doing any wrong. It is on bitbooks.biz I am going to alert the owner once I see there is actually a problem.

It is a way to place bet but yet transfer the money out in case you are going to lose, just a flaw in their system.

I just want to make it perfectly clear that I have NO intentions on keeping the BTC earned from this.
______________________________________________________
Re: Great site!!!!!
« Sent to: BayAreaCoins on: Today at 01:45:23 PM »
« You have forwarded or responded to this message. »
Quote  Reply  Delete  
Sure, noted.
_________________________________________________
Re: Great site!!!!!
« Sent to: addi on: Today at 02:11:38 PM »
Quote  Reply  Delete  
Gosh I am nervous that they keep my 19BTC but I had to try the flaw on a large scale to see if it worked!  
(just threw up I am so worried lol, I placed like 200BTC worth of bets with 19BTC.)

Thank you very much BTW man I will keep you up to date



Here is my post on my Free Escrow service:
https://bitcointalk.org/index.php?topic=257222.0

Well that is my findings and I hope I have proved beyond a shadow of a doubt that my accounts frozen/pending withdraws were not of ill mannered/nor would I have stolen the coins.  Hopefully this is clearly enough written so I can recover my test BTC.

It is important to myself that I build a positive rep here on the site, especially since I plan on Buying/Selling BTC face to face as a store front.

My frozen BTC can be sent to 1EgN9QatDmmxEiBDxVbqj8cWrV2AFFpdkb (this is a bitbook.biz account as well.)

I was refunded in full.

Thank you for your reading pleasure!
BAC

[Moneymaker1990]

Watching how this plays out.

[KingOfSports]

To be honest it was good of you to do this, BUT I would've PMed them or contacted them before hand so that they could fix this before other people found out...now the problem might get out of hand bigtime if it has not been fixed yet.

[BayAreaCoins]

Agree, the information has been taken down because I, like Bitbook.biz am a stand up guy.  

Fingers crossed they can bounty 20+ because that would put me back to even for betting (20+15.1 of course)
I feel like that is totally fair, I could have sold this to someone for 30BTC with no problem. That is only the cost of 2 bet errors!

Kingofsports can you confirm the problem still exists so someone can't just say "He was 14 post, SCAMMER SCAMMER *blah blah blah*"

(I have PM'ed them several times trying to explain, but my writing skills are not the best   )

[KingOfSports]

Agree, the information has been taken down because I, like Bitbook.biz am a stand up guy. 

Fingers crossed they can bounty 20+ because that would put me back to even for betting (20+15.1 of course)

Kingofsports can you confirm the problem still exists so someone can't just say "He was 14 post, SCAMMER SCAMMER *blah blah blah*"

(I have PM'ed them several times trying to explain, but my writing skills are not the best  )

All of my BTC is in exchanges in USD form at the moment. Sorry I cannot help you out atm.

[BayAreaCoins]

No problem, it is well enough documented I am not worried about it! If I was worried about Bitbook.biz I wouldn't have bet with them in the first place!  But come on let's get this problem fixed so I can share what I found (unless paid off to be gagged)

[bitbook.biz]

Alright, so here are some facts about the situation:

• BayAreaCoins believed he had identified an exploitable flaw in BitBook
• BayArea did not notify us or attempt to prove the exploit on a small scale (as someone not trying to scam us would have)
• Rather, he immediately attempted to place a large number of big bets on which he thought we were being free-rolled
• We very quickly detected his activity and locked his accounts
• Only after he realized that his scam wasn't working did he contact us
• The potential exploit he is referencing does not exist anymore and there is no danger to other users
• Bottom-line: BayArea attempted to scam us (for hundreds of BTC) and failed

It's also notable that BarArea joined the forum just yesterday and has already been accused by other members of being a scammer (one of his first actions was to create an escrow service -- sketchy)

We've currently got 15 coins that he is asking for. So then, what's the right thing to do? Return them? Donate some to the Bitcoin foundation? Seriously, we're open to suggestions from the community. What do you all think?

[BayAreaCoins]

If I was interested in scamming you I would have continued to bet on the Account BetBetBet and transfered out like I did the first time

I even PULLED DOWN THE PROBLEM SO YOU COULD FIX IT.

This is a PM from KingofSports

No problem, I am sure they will follow thru with helping you. They will take your 4 BTC loss though just saying, its only fair.

I escrow the information with Satoshibet.com own for this EXACT reason. Please check the times and you will see

[bitbook.biz]

The messages that you posted are time stamped after we caught you and locked your account.

[KingOfSports]

Please do not make me involved in this. I am not the owner but in this case I would refund with the possiblity of banning if he truly did not have ill intentions, however that is not my decision to make. However, donating his funds or otherwise when he seemed to go out of his way to make it known he was trying to fix an error would be a bit of bad publicity. However, I do not know the timestamps on when it all happened. If you froze his accounts and then he came on here telling people about it thru PMs and sorts then that looks bad on the player, because then it looks like he played the "I was going to tell you when I was sure of the error!" game.

[BayAreaCoins]

The messages that you posted are time stamped after we caught you and locked your account.

Time stamp the information I sent to everyone else with the PM's/Posting on my free escrow about the problem...
Time stamp "Free escrow post"  https://bitcointalk.org/index.php?topic=257222.0

The calling me a scammer was posted here:

https://bitcointalk.org/index.php?topic=256606.0

Here is proof I actually won what I won:

Hi, just want to chime in, I'm the founder behind SatoshiBet.com

I can confirm this really happened. Congratulations again!

Adrian

as seen: https://bitcointalk.org/index.php?topic=256542.20

July 16, 2013, at 05:14am PDT
Amount Received

15.00 BTC
From Coinbase (transfers@coinbase.com)
To You


My first series of bets was on the Williams game I believe all the way for 1 hour+ my PM's with escrow information were WELL BEFORE being frozen.  I am smart if I wanted to steal I would have continued using the Betbetbet account NOT spamming accounts/Escrowing INFO. DO NOT GIVE MY BTC AWAY I have to make a house payment on the first

[bitbook.biz]

Please do not make me involved in this. I am not the owner but in this case I would refund with the possiblity of banning if he truly did not have ill intentions, however that is not my decision to make. However, donating his funds or otherwise when he seemed to go out of his way to make it known he was trying to fix an error would be a bit of bad publicity. However, I do not know the timestamps on when it all happened. If you froze his accounts and then he came on here telling people about it thru PMs and sorts then that looks bad on the player, because then it looks like he played the "I was going to tell you when I was sure of the error!" game.

Thanks King.

The timing of his actions make it very clear that he was not interested in helping fix a problem. He only reached out to us when it was clear he had failed.

[BayAreaCoins]

Re: Great site!!!!!
« Sent to: addi on: Today at 01:27:49 PM »
Reply with quoteQuote  ReplyReply  Remove this messageDelete  
Yes thank you.  Would you mind if I use you as escrow for information I just found out so it doesn't look like I am trying to steal BTC from a error I just found on a website?

I don't want them to keep my 19BTC (it is in the process of being sent out of their accounts) because they though I was trying to rip them off, I am going to alert the site owner once I see that the site actually has a flaw

Just worried they may have to manually approve the 19BTC (which they very well may not) and they will think I am trying to steal.

I am going to ask them for a good size bounty of course because it is a major error.

_______________________________________________________________________________ ____________________________
https://blockchain.info/address/1L8XoWuf35GinnnBTAYPEJaN1xfZhpVDH5

Compared to the .1 sent to the account Wallet2Win (which is the frozen wallet with 15.1BTC of MINE) You will see that I am in the right, I even pulled the information down so you guys had a chance to fix it. Please give my coins back or contact Addi. I contacted Addi WAY before anything was ever frozen just to cover my ass


_______________________________________________________________________________ _____________________________

If I had any intent of scamming I would have continued to do what I did on the account Betbetbet, that is obvious for ANYONE who is DECENT with a computer.

I didn't contact you first because
A:I wasn't going to steal
B: I escrowed the information AND posted about it https://bitcointalk.org/index.php?topic=257222.0
C: I do not ever want to "Cry wolf", I want what I say to be taken in a serious manner

I did NOT fail at taking my 4BTC back from my 4 bet parley, I went above and beyond even removing the "How to Post" so you guys could fix your problem

[BayAreaCoins]

Alright, so here are some facts about the situation:

• BayAreaCoins believed he had identified an exploitable flaw in BitBook
• BayArea did not notify us or attempt to prove the exploit on a small scale (as someone not trying to scam us would have)
• Rather, he immediately attempted to place a large number of big bets on which he thought we were being free-rolled
• We very quickly detected his activity and locked his accounts
• Only after he realized that his scam wasn't working did he contact us
• The potential exploit he is referencing does not exist anymore and there is no danger to other users
• Bottom-line: BayArea attempted to scam us (for hundreds of BTC) and failed

It's also notable that BarArea joined the forum just yesterday and has already been accused by other members of being a scammer (one of his first actions was to create an escrow service -- sketchy)

We've currently got 15 coins that he is asking for. So then, what's the right thing to do? Return them? Donate some to the Bitcoin foundation? Seriously, we're open to suggestions from the community. What do you all think?

And you taunt me with my own coins? What kind of site owner is that "So then, what's the right thing to do? Return them? Donate some to the Bitcoin foundation? Seriously, we're open to suggestions from the community. What do you all think?"

You should match my PM/Post/block chain info up and you will SEE that my account was NOT frozen before I start reaching out to people.  I am a positive person and never have had to steal anything IN MY LIFE. I will NOT start today, I am here to buy/sell BTC cash in person in SF area.

What scammer even takes a picture of a 0/16 pending error, ANSWER: None

[cp1]

Either keep his coins or donate them to charity.

[RavinTavin]

Give his coins back, I will serve as a witness on his behalf.

[BayAreaCoins]

Release what time you froze the account because the blockchain of .1 sent to Wallet2Win was approved before being frozen and the PM's/post I have linked are WELL BEFORE the .1 was posted.

You can't lie about blockchain. 

I am prepare to use online arbitration. All of my numbers match up jack

[BayAreaCoins]

uvwvj:

If you match my blockchain .1 transfer with the PM's/post on my escrow site you will see that I was bringing this to everyones attention far before being frozen.  

Thank you for your honesty, I am so disappointed with how Bitbook.biz has handled this.

I was actually pretty pumped when I get praise from Kingofsports.

Edit:
I do NOT deserve a scammer tag. Please match up all my info before associating that word with me. It is obvious it all matches up and check my escrow information

1H7WqHzKsuHAd2bMhN16hBCAEtsJ31EfWK

[KingOfSports]

uvwvj:

If you match my blockchain .1 transfer with the PM's/post on my escrow site you will see that I was bringing this to everyones attention far before being frozen. 

Thank you for your honesty, I am so disappointed with how Bitbook.biz has handled this.

I was actually pretty pumped when I get praise from Kingofsports

I did not praise you, I wished you luck and said they would appreciate you telling them of the error. I do not know all the details and am staying neutral in this matter. I hope the outcome is one that is satisfying to both parties.

[Damnsammit]

By your own account, you say that he tried to scam you.

If you don't return his coins you are stealing from him.

No?