[ANN][XCP] Counterparty - Pioneering Peer-to-Peer Finance - Official Thread

[delulo]

Is the JahPowerBit client safe in terms of the bug and is this the easiest way to send xcp?

yes, bug is in protocol, not GUI - currently  this is the easiest way to send. although a web-wallet is due

Ok. Thanks!

two left: At which price (above 0.02?) did the attack occur where people lost their funds? And is there a description (technical details) of the bug?

[flayway]

Is the JahPowerBit client safe in terms of the bug and is this the easiest way to send xcp?

yes, bug is in protocol, not GUI - currently  this is the easiest way to send. although a web-wallet is due

Ok. Thanks!

two left: At which price (above 0.02?) did the attack occur where people lost their funds? And is there a description (technical details) of the bug?

0.01-0.002

[busoni]

To be honest, I'm quite surprised and delighted at how everyone is taking this and handling it. I was half-expecting all hell to break loose when I said that we're going to have to assume the BTC is lost for now. Someone asked which address contains the 115 BTC the hacker took. You can see everything here: https://blockchain.info/address/134V1Rt8tBtz7RuydzBtvfuNNfyHmDCHSp

Two questions for the community:

1. 2.5% trading fee? That's huge--is everyone really okay with this? It would only apply to BTC/XCP.

2. I feel that getting the exchange back up soon is a good idea, so we can start to put this behind us. But someone has suggested waiting a few weeks. Which one do people favor? New security measures on Poloniex will prevent a similar exploit from having any impact, although if the XCP were stolen from a place other than Poloniex and put into Poloniex, a person could still get away with it, provided they made deposits gradually. There is also a 50 BTC minimum daily withdrawal.

[busoni]

Also--someone asked about the trades the hacker made and how they could amount to 150BTC. Here is every trade made during the dump (I think one or two trades may be missing from the top):

Code:

Rate	        Amount	        Total
0.00970000	0.63512061	0.006160669917
0.00960000	50.00000000	0.48
0.00960000	18.81155104	0.180590889984
0.00950000	48.34660463	0.459292743985
0.00930000	30.00000000	0.279
0.00925838	51.67372694	0.478415000026757
0.00925000	21.62162270	0.200000009975
0.00920000	0.21647608	0.001991579936
0.00912100	66.00000000	0.601986
0.00912100	0.10000000	0.0009121
0.00912000	13.58992872	0.1239401499264
0.00910110	41.75319467	0.380000000011137
0.00910000	219.76923077	1.999900000007
0.00910000	5.00000000	0.0455
0.00910000	11.00000000	0.1001
0.00905000	100.00000000	0.905
0.00901000	100.00000000	0.901
0.00900110	300.00000000	2.70033
0.00900000	36.00000000	0.324
0.00900000	400.00000000	3.6
0.00900000	222.22222222	1.99999999998
0.00900000	20.00000000	0.18
0.00900000	158.00000000	1.422
0.00900000	27.00000000	0.243
0.00880000	200.00000000	1.76
0.00865000	17.49255606	0.151310609919
0.00856000	46.54672897	0.3984399999832
0.00852000	200.00000000	1.704
0.00851100	100.00000000	0.8511
0.00851000	350.00000000	2.9785
0.00850010	7.24769355	0.061606119944355
0.00850000	0.50000000	0.00425
0.00850000	41.17647059	0.350000000015
0.00850000	155.00000000	1.3175
0.00850000	30.00000000	0.255
0.00850000	3.16070588	0.02686599998
0.00836010	313.31572947	2.61935082994215
0.00833254	57.41526593	0.478414999972362
0.00830000	1.00000000	0.0083
0.00825000	60.67611272	0.50057792994
0.00825000	0.50000000	0.004125
0.00824000	20.00000000	0.1648
0.00823000	35.23693924	0.2900000099452
0.00822000	99.30740735	0.816306888417
0.00818000	3.62940220	0.029688509996
0.00816000	20.00000000	0.1632
0.00815000	5.00000000	0.04075
0.00814300	307.10000000	2.5007153
0.00814210	5.00000000	0.0407105
0.00813000	83.39483394	0.6779999999322
0.00812300	30.00000000	0.24369
0.00812000	24.63054187	0.1999999999844
0.00812000	277.00000000	2.24924
0.00811000	250.00000000	2.0275
0.00810000	50.00000000	0.405
0.00810000	10.00000000	0.081
0.00801000	33.00000000	0.26433
0.00800200	6.00000000	0.048012
0.00800000	62.50000000	0.5
0.00800000	64.54000000	0.51632
0.00800000	20.00000000	0.16
0.00800000	56.00000000	0.448
0.00800000	3.00000000	0.024
0.00800000	2.00000000	0.016
0.00800000	13.00000000	0.104
0.00800000	54.00000000	0.432
0.00800000	400.00000000	3.2
0.00800000	100.00000000	0.8
0.00790000	20.00000000	0.158
0.00750000	38.66666666	0.28999999995
0.00749929	63.79470590	0.478415000008811
0.00725000	46.43356965	0.3366433799625
0.00720000	58.25518055	0.41943729996
0.00711000	250.00000000	1.7775
0.00710000	140.00000000	0.994
0.00705000	100.00000000	0.705
0.00700000	20.00000000	0.14
0.00700000	500.00000000	3.5
0.00700000	14.00000000	0.098
0.00700000	20.00000000	0.14
0.00700000	100.00000000	0.7
0.00674936	70.88301706	0.478415000024082
0.00670001	14.92535086	0.100000000015509
0.00670000	1400.00000000	9.38
0.00670000	1.01000000	0.006767
0.00658999	575.00000000	3.78924425
0.00630000	120.00000000	0.756
0.00630000	13.00000000	0.0819
0.00613000	4.00000000	0.02452
0.00612300	123.00000000	0.753129
0.00612100	22.15896095	0.13563499997495
0.00611000	2.00000000	0.01222
0.00610000	0.80000000	0.00488
0.00607442	78.75895970	0.478414999980874
0.00606000	33.00000000	0.19998
0.00605010	1.60000000	0.00968016
0.00605000	180.00000000	1.089
0.00601000	150.00000000	0.9015
0.00600000	20.00000000	0.12
0.00600000	15.00000000	0.09
0.00600000	25.00000000	0.15
0.00600000	1.00250000	0.006015
0.00600000	600.00000000	3.6
0.00580000	1.00250000	0.0058145
0.00560000	1.00250000	0.005614
0.00550000	196.54272000	1.08098496
0.00546698	87.50992321	0.478414999990606
0.00541150	379.00000000	2.0509585
0.00541140	500.00000000	2.7057
0.00541130	500.00000000	2.70565
0.00541120	500.00000000	2.7056
0.00541111	500.00000000	2.705555
0.00541111	500.00000000	2.705555
0.00541110	500.00000000	2.70555
0.00541100	500.00000000	2.7055
0.00541000	500.00000000	2.705
0.00540000	500.00000000	2.7
0.00540000	1.00250000	0.0054135
0.00530000	9.75980754	0.051726979962
0.00520000	1.00250000	0.005213
0.00510003	30.00000000	0.1530009
0.00510000	56.86274705	0.290000009955
0.00510000	20.00000000	0.102
0.00510000	20.00000000	0.102
0.00500001	8.55999088	0.0428000399999088
0.00500000	5.00000000	0.025
0.00500000	1.00250000	0.0050125
0.00500000	71.00000000	0.355
0.00500000	21.00000000	0.105
0.00500000	99.89999999	0.49949999995
0.00500000	19.20000000	0.096
0.00492028	97.23328754	0.478415000017311
0.00480000	1.00250000	0.004812
0.00460000	1.00250000	0.0046115
0.00450000	100.00000000	0.45
0.00450000	1.66533777	0.007494019965
0.00442825	108.03703495	0.478415000017337
0.00430000	4.30000000	0.01849
0.00410000	134.00000000	0.5494
0.00400000	125.00000000	0.5
0.00400000	30.00000000	0.12
0.00387464	1.00000000	0.00387464
0.00351001	28.48995017	0.100000009996202
0.00351000	150.00000000	0.5265
0.00342825	29.16940130	0.100000000006725
0.00301200	159.00000000	0.478908
0.00300000	10.00000000	0.03
0.00242825	41.18192114	0.100000000008205
0.00220000	50.00000000	0.11
0.00210000	6.50000000	0.01365
0.00200000	18.00000000	0.036
0.00200000	409.62906500	0.81925813
0.00200000	350.00000000	0.7
0.00200000	500.00000000	1
0.00200000	500.00000000	1
0.00200000	500.00000000	1
0.00200000	7000.00000000	14
0.00200000	500.00000000	1
0.00200000	3.43541999	0.00687083998
0.00200000	100.00000000	0.2
0.00200000	1579.54462000	3.15908924
0.00200000	550.00000000	1.1
0.00200000	3.64400500	0.00728801
0.00200000	50.00000000	0.1
0.00200000	200.00000000	0.4
0.00200000	0.38173999	0.00076347998
0.00200000	29.04196000	0.05808392
0.00200000	249.90000000	0.4998
0.00200000	5.00000000	0.01
0.00200000	8.80000499	0.01760000998
0.00200000	3.59999999	0.00719999998
0.00200000	0.69150500	0.00138301
0.00200000	88.00000000	0.176
0.00200000	2.00000000	0.004
0.00200000	60.00000000	0.12
0.00200000	9.00000000	0.018
0.00200000	55.22225500	0.11044451
0.00200000	95.55550000	0.191111
0.00200000	380.27584500	0.76055169
0.00200000	5.40000000	0.0108
0.00200000	500.00000000	1
0.00200000	10.74172500	0.02148345
0.00200000	1.00000000	0.002
0.00200000	150.00000000	0.3
0.00200000	20.00000000	0.04
0.00200000	77.33378500	0.15466757
0.00200000	78.79231500	0.15758463
0.00200000	20.00000000	0.04
0.00200000	15.00000000	0.03
0.00200000	98.25000500	0.19650001
0.00200000	30.00000000	0.06
0.00200000	50.00000000	0.1
0.00200000	300.00000000	0.6
0.00200000	500.00000000	1
0.00200000	2902.43165102	5.80486330204
0.00142825	1.50000000	0.002142375
0.00142825	70.01575354	0.099999999993505
0.00121000	43.66541401	0.0528351509521
		
		
	       Total:	149.48447431937

[davidpbrown]

I'm not sure where the 2.5% trading fee is coming from but I don't see that's a problem at this early stage. If that's far beyond other coins or exchanges, then obviously it's to be expect you might adjust that to match later on.

I'd prefer seeing XCP back on Poloniex asap. I'm keen to double down having seen the devs and community work through such an issue so well.

[jayso043]

How do we know that the clever hacker is not waiting for another go, with another trick? Lets wait a few weeks for the bug bounty to progress.

[supervine]

Put back the exchange ASAP. Waiting few weeks (and holding peoples money from using on other exchanges) will be the end of the project (lot of negative impact and lost faith in future on the coin)

[whoracle]

ASAP

[peled1986]

Code:

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\Peled>counterpartyd.exe -V
counterpartyd v6.0

C:\Users\Peled>counterpartyd.exe wallet
Traceback (most recent call last):
  File "C:\counterpartyd_build\env\lib\site-packages\requests\packages\urllib3\u
til.py", line 625, in ssl_wrap_socket
IOError: [Errno 2] No such file or directory

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:\counterpartyd_build\env\lib\site-packages\requests\adapters.py", line
 324, in send
  File "C:\counterpartyd_build\env\lib\site-packages\requests\packages\urllib3\c
onnectionpool.py", line 478, in urlopen
  File "C:\counterpartyd_build\env\lib\site-packages\requests\packages\urllib3\c
onnectionpool.py", line 285, in _make_request
  File "C:\Python32\Lib\http\client.py", line 983, in request
    self._send_request(method, url, body, headers)
  File "C:\Python32\Lib\http\client.py", line 1021, in _send_request
    self.endheaders(body)
  File "C:\Python32\Lib\http\client.py", line 979, in endheaders
    self._send_output(message_body)
  File "C:\Python32\Lib\http\client.py", line 824, in _send_output
    self.send(msg)
  File "C:\Python32\Lib\http\client.py", line 762, in send
    self.connect()
  File "C:\counterpartyd_build\env\lib\site-packages\requests\packages\urllib3\c
onnection.py", line 95, in connect
  File "C:\counterpartyd_build\env\lib\site-packages\requests\packages\urllib3\u
til.py", line 629, in ssl_wrap_socket
requests.packages.urllib3.exceptions.SSLError: [Errno 2] No such file or directo
ry

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:\counterpartyd_build\dist\counterpartyd\lib\util.py", line 277, in ver
sions_check

  File "C:\counterpartyd_build\env\lib\site-packages\requests\api.py", line 55,
in get
  File "C:\counterpartyd_build\env\lib\site-packages\requests\api.py", line 44,
in request
  File "C:\counterpartyd_build\env\lib\site-packages\requests\sessions.py", line
 382, in request
  File "C:\counterpartyd_build\env\lib\site-packages\requests\sessions.py", line
 485, in send
  File "C:\counterpartyd_build\env\lib\site-packages\requests\adapters.py", line
 379, in send
requests.exceptions.SSLError: [Errno 2] No such file or directory

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:\Python32\lib\site-packages\cx_Freeze\initscripts\Console3.py", line 2
7, in <module>
  File "C:\counterpartyd_build\dist\counterpartyd\counterpartyd.py", line 489, i
n <module>
    args.unsigned)
  File "C:\counterpartyd_build\dist\counterpartyd\lib\util.py", line 280, in ver
sions_check
    host = 'https://raw2.github.com/PhantomPhreak/counterpartyd/master/versions.
json'
lib.exceptions.DatabaseVersionError: Unable to check client, database versions.
How's your Internet access?

C:\Users\Peled>

I upgraded to V6.0 and i have this issue also.
can anyone help?

[Patel]

Latest is 6.1, thats the one I am on

[cubicdissection]

+1 ASAP

[cubicdissection]

There is also a 50 BTC minimum daily withdrawal.

Do you mean maximum?

[Ximp]

There is also a 50 BTC minimum daily withdrawal.

Do you mean maximum?

No, either you withdraw 50 BTC per day or your account is suspended.

[kdrop22]

Yes, 2.5% trading fees sounds good to me.
We need to do whatever we need to do to get it trading again on Poloniex.

[busoni]

There is also a 50 BTC minimum daily withdrawal.

Do you mean maximum?

No, either you withdraw 50 BTC per day or your account is suspended.

  That would be maximum.

I also think trading should be resumed, and the 2.5% fee seems like a good way to get donations. No one's really donating to the donation account--it has 43 XCP in it. I believe the developers also favor resuming trading as soon as possible.

For people worried about the hacker having something else up his sleeve--even if he had an identical exploit, it would be a lot harder for him to get away with it, and actually, it doesn't particularly help to leave the exchange down. If he had another exploit, he could still steal out of the wallet whether trading is live or not.

Even so, I encourage those still worried to withdraw their XCP as soon as withdrawals are available.

[ddink7]

To be honest, I'm quite surprised and delighted at how everyone is taking this and handling it. I was half-expecting all hell to break loose when I said that we're going to have to assume the BTC is lost for now. Someone asked which address contains the 115 BTC the hacker took. You can see everything here: https://blockchain.info/address/134V1Rt8tBtz7RuydzBtvfuNNfyHmDCHSp

Two questions for the community:

1. 2.5% trading fee? That's huge--is everyone really okay with this? It would only apply to BTC/XCP.

2. I feel that getting the exchange back up soon is a good idea, so we can start to put this behind us. But someone has suggested waiting a few weeks. Which one do people favor? New security measures on Poloniex will prevent a similar exploit from having any impact, although if the XCP were stolen from a place other than Poloniex and put into Poloniex, a person could still get away with it, provided they made deposits gradually. There is also a 50 BTC minimum daily withdrawal.

That fee sounds perfectly reasonable.

I think we need to restart trading ASAP. Being down for days is bad enough; if we are down for weeks it could be devastating.

[IamNotSure]

To be honest, I'm quite surprised and delighted at how everyone is taking this and handling it. I was half-expecting all hell to break loose when I said that we're going to have to assume the BTC is lost for now. Someone asked which address contains the 115 BTC the hacker took. You can see everything here: https://blockchain.info/address/134V1Rt8tBtz7RuydzBtvfuNNfyHmDCHSp

Two questions for the community:

1. 2.5% trading fee? That's huge--is everyone really okay with this? It would only apply to BTC/XCP.

2. I feel that getting the exchange back up soon is a good idea, so we can start to put this behind us. But someone has suggested waiting a few weeks. Which one do people favor? New security measures on Poloniex will prevent a similar exploit from having any impact, although if the XCP were stolen from a place other than Poloniex and put into Poloniex, a person could still get away with it, provided they made deposits gradually. There is also a 50 BTC minimum daily withdrawal.

Here's my 2 cent

2,5% is a lot Personally i'd be a turn off but if other are ok, why not if it covers the loss. I'd have suggested a temporary 1%. This could have to side effect of being an incentive of using the DEX !

Be sure to double check all security measure. While we appreciate you communication & transparency, if an event like this happens again, even of a lower magnitude, you won't be forgived easily (even if you weren't hacked in the first place, but just a lack of proper security for big withdrawals IMO while allowing a trading pair with an coin still in alpha)

50 BTC limit seems a lot Make it 20 and force a manual process of the withdrawals when this limit reaches 5 BTC.

"Man the flak gun!" meaning, be sure to monitor the exchange 24/7 when you'll relaunch it, and be prepared to freeze XCP trades and all withdrawals in a matter of seconds. You are responsible of people's money here.

Some are eagerly waiting for a centralized exchange, that means they're will be taking the risk of losing their money if something goes wrong.

That being said, XCP should be far stronger now. And I guess a disaster of this magnitude is less likely to happen.

PS: On, c ounterparty forum, I have suggested to make an IPO of a small part of the site revenue, that could attract investors and capital to cover the loss by giving something in return. You could crunch some numbers based on cryptsy IPO and weekly yield.

[kdrop22]

a) Make the maximum withdrawal - 25 BTC/day.
b) Put 20% of BTC in hot wallet, the rest in Cold storage.

[IamNotSure]

b) Put 20% of BTC in hot wallet, the rest in Cold storage.

Indeed, that goes without saying !

[TheMightyX]

To be honest, I'm quite surprised and delighted at how everyone is taking this and handling it. I was half-expecting all hell to break loose when I said that we're going to have to assume the BTC is lost for now. Someone asked which address contains the 115 BTC the hacker took. You can see everything here: https://blockchain.info/address/134V1Rt8tBtz7RuydzBtvfuNNfyHmDCHSp

Two questions for the community:

1. 2.5% trading fee? That's huge--is everyone really okay with this? It would only apply to BTC/XCP.

2. I feel that getting the exchange back up soon is a good idea, so we can start to put this behind us. But someone has suggested waiting a few weeks. Which one do people favor? New security measures on Poloniex will prevent a similar exploit from having any impact, although if the XCP were stolen from a place other than Poloniex and put into Poloniex, a person could still get away with it, provided they made deposits gradually. There is also a 50 BTC minimum daily withdrawal.

1. We understand it is high but temporary.
2. Any delay in getting the exchange back up will result in a longer delay in returning peoples funds.

Any potential bugs in the protocol should now be irrelevant (regarding the safety of continued trading) assuming you have security measures in place that prevent malicious users from withdrawing ill-gotten gains from the site.

Busoni what is your position regarding your accountability on the loss of users funds?
I assume you don't expect the community to make up 100% of the lost funds.