Launching the Beta of EBitcoinBetting.com! - A Bitcoin Sportsbook

[steveds]

i read the part about the credit to the website and my balance on there is 0.00btc

Dude, read.

I will credit the first 10 people who are willing to beta test the site with .1 BTC on August, 28th. That is when we are officially planning to launch the site to allow wager with real money. If would like to do this, PM me with the username that you registered with on EBitcoinBetting.com with and let us know.

i have pmed him my username dude

You still aren't reading. August 28th! today is the 23rd.

oh shit didnt see that date thanks

[1714058054]

1714058054

[1714058054]

1714058054

[icecube]

Well, that's today

[steveds]

i was credited and i withdrew some still waiting for the btc to come to my blockchain wallet

[icecube]

i was credited and i withdrew some still waiting for the btc to come to my blockchain wallet

He hasn't been on since 8/24.

[steveds]

idk i was credited and bet and waiting for the money to come to my wallet
also his email might be best to contact him

[EBitcoinBetting]

I'm here, we're just fixing some hiccups! I will award you guys with .1 later on tonight. Just gotta fix some of the little annoyances.

[icecube]

Hi, I deposited and I am unable to withdraw. Also never received .1

[EBitcoinBetting]

Hi, I deposited and I am unable to withdraw. Also never received .1

I messaged you.

[mscharleneb]

Hi there,
I'd be interested in beta testing for you.

I just registered.

Username: mscharleneb

Please keep us posted on any future updates regarding the site launch or anything of the like.

Best of luck with your new website!

Kind regards,
Charlene

To EbitcoinBetting,
I was never credited either. Please see my first post to this thread above.

I'm looking forward to betting on your site

[EBitcoinBetting]

We have awarded the following players with .1 BTC:

mscharleneb
uvwvj
dree12
KingOfSports
HollowIP
bitcoinsrock
spurs32
cparsley
Icecube
rogerto

We decided on the picking the players that have contributed the most to Bitcointalk.org community. We've messaged whoever did not list their username. You are can pick any bet and your winnings + risk will be rewarded. We will not withdraw the credited BTC if it has not been used to place on a bet. Please let us know if you have any questions and don't hesitate to report and bugs or things that we can improve on. Good luck!

EBitcoinBetting.com

[dree12]

Review

A well-designed site, but there are many issues.

First the big stuff

CSRF vulnerability

There is a major CSRF^[1] vulnerability in various parts of your website. A malicious attacker can exploit this vulnerability to steal funds from bettors. Please PM me if you need any more information on this issue.

Most visible is the withdrawal script. An attacker can update the withdrawal destination and withdraw arbitrary amounts from user balance. A malicious webpage contains two inline frames, one of which updates the withdrawal address through a POST to http://ebitcoinbetting.com/account.php?id=2&a=1, and the other which withdraws money through another POST to http://ebitcoinbetting.com/account.php?id=2&a=2.

As far as I can tell, this isn't a problem with the password change form because the old password is required. This is also not likely a problem with betting, as there is a confirmation screen for that. Confirmations screens are generally poor at solving CSRF attacks, however, and care should be taken.

(On a related note, withdrawal does not currently work. The error given is:)

Catchable fatal error: Object of class mysqli_stmt could not be converted to string in /home3/dokula/public_html/ebit/account.php on line 186

• ^[1]: More information on CSRF and how to prevent it.

Some thoughts

Combined login/register

The combined login/register form is a bad idea. When I went to log in, I had to scroll down to see the “Login” button and initially thought I should fill my information in the upper form, which was instead for “Register”ing.

Logo discrepancy

The logo, which says “EBitCoingBetting”, is confusing. The site's name is given elsewhere as “EBitcoinBetting”, without the “g” that follows the “Bitcoin”. Regardless of whether this is an error or an intentional discrepancy, it is a source of confusion. Brand should be unified, even if the difference is only a “g”.

Cosmetic balance display issue

On two separate occasions, the “Balance in use” shows nothing when no balance is being used. See: and .

Username issue?

On the deposit page, my username is displaying thus:

Hey, l3jNF!

The username I signed up with is not l3jNF. I'm not sure what this is. Perhaps this is intentional, but clarification would be helpful if that is the case.

Bet sizes

The minimum bets for all the ones I can see is 0.21 BTC. Not sure if this is intentional, again, but it certainly makes testing the bet system hard, since we only have 0.1 BTC to work with...

[EBitcoinBetting]

Thanks,

Was able to reset my password, via the email verification link.

Site is a little hard to navigate around and I had to look for Football then click NCAA to make some bets.  Also not a very good checkout area, errors and errors trying to get a parlay to work, 

Minimum Bet: .21 BTC
Maximum Bet: .24 BTC
Incorrect table name ''349

What I did like it had the old parlay feel, I remember 25 years ago being 10 picking my 11 teams on my Dad's slip he was going to play for me for $1, but when i got to be 20 I realized it was a rouse and no 10 year old could pick a 11 teamer with odds.  But I remember doing that though.

I tried and was unable to make my bets on a 4 team parlay

I want play the full 0.10 BTC on
South Carolina ML -530
SMU H:5 -106
LSU ML -180
FSU ML -371

I will try again tonight and hopefully be back before kickoff tonight, or if you can get in put in that would greatly be appreciated.

All of these issues have been fixed. Let me know if you cannot place the bet, then I will do it myself.

[EBitcoinBetting]

Review

A well-designed site, but there are many issues.

First the big stuff

CSRF vulnerability

There is a major CSRF^[1] vulnerability in various parts of your website. A malicious attacker can exploit this vulnerability to steal funds from bettors. Please PM me if you need any more information on this issue.

Most visible is the withdrawal script. An attacker can update the withdrawal destination and withdraw arbitrary amounts from user balance. A malicious webpage contains two inline frames, one of which updates the withdrawal address through a POST to http://ebitcoinbetting.com/account.php?id=2&a=1, and the other which withdraws money through another POST to http://ebitcoinbetting.com/account.php?id=2&a=2.

As far as I can tell, this isn't a problem with the password change form because the old password is required. This is also not likely a problem with betting, as there is a confirmation screen for that. Confirmations screens are generally poor at solving CSRF attacks, however, and care should be taken.

(On a related note, withdrawal does not currently work. The error given is:)

Catchable fatal error: Object of class mysqli_stmt could not be converted to string in /home3/dokula/public_html/ebit/account.php on line 186

• ^[1]: More information on CSRF and how to prevent it.

Some thoughts

Combined login/register

The combined login/register form is a bad idea. When I went to log in, I had to scroll down to see the “Login” button and initially thought I should fill my information in the upper form, which was instead for “Register”ing.

Logo discrepancy

The logo, which says “EBitCoingBetting”, is confusing. The site's name is given elsewhere as “EBitcoinBetting”, without the “g” that follows the “Bitcoin”. Regardless of whether this is an error or an intentional discrepancy, it is a source of confusion. Brand should be unified, even if the difference is only a “g”.

Cosmetic balance display issue

On two separate occasions, the “Balance in use” shows nothing when no balance is being used. See: https://i.imgur.com/3bB0NsB.png and https://i.imgur.com/YX8jDN0.png.

Username issue?

On the deposit page, my username is displaying thus:

Hey, l3jNF!

The username I signed up with is not l3jNF. I'm not sure what this is. Perhaps this is intentional, but clarification would be helpful if that is the case.

Bet sizes

The minimum bets for all the ones I can see is 0.21 BTC. Not sure if this is intentional, again, but it certainly makes testing the bet system hard, since we only have 0.1 BTC to work with...

All of these have been fixed as well. Amazing write up! Thank you!

[icecube]

Hi, I deposited and I am unable to withdraw. Also never received .1

I messaged you.

Icecube, same I account as here
I PM'd you also.

[icecube]

Hi, I deposited and I am unable to withdraw. Also never received .1

I messaged you.

Icecube, same I account as here
I PM'd you also.

Still unable and never received the .1

[KingOfSports]

My account is kingofsports for the .1 BTC to be added. Thanks and look forward to trying the site out.

[steveds]

Guys email him he will reply within 24hrs

[KingOfSports]

Sounds like you are over your head and not around enough.

[EBitcoinBetting]

Sounds like you are over your head and not around enough.

I'm around. Trying to fix the issues. One more week until NFL season starts and things should be running smoothly. Did not anticipate the amount of hiccups. Things will get rolling smoothly coming opening day of the NFL season.

[steveds]

Sounds like you are over your head and not around enough.

I'm around. Trying to fix the issues. One more week until NFL season starts and things should be running smoothly. Did not anticipate the amount of hiccups. Things will get rolling smoothly coming opening day of the NFL season.

my bet is still being not finshed yet the game finshed yesterday