New Mt Gox Press Release - Feb 10 - they are claiming flaw in bitcoin protocol !

[yannis7777]

Worst thing is not to panic sell. Rather it is to purchase at the start of the panicking process.
MtGox manipulate the market indirectly this is so effin apparent.

[goxed]

<-
Mountain out of a molehole. goxstyle. to buy in cheap btc. buggers!

[CoinShovel]

How can we get MT Gox stripped from the Bitcoin Foundation along with it's CEO, Mark Karpeles?

This is doing tremendous damage to the community and they're still plastered all over the face of the Foundation that is supposed to be helping the community grow.

Keep protesting and demanding he resign or be booted out.

I would assume other BF members have some pull and can force a resignation as well as also strip away a "Platinum" membership rating.

[Meuh6879]

If that's the case, I'd hope that the core developers would continue working on Bitcoin's problem with scaling, and not escalate the malleability thing much at all.

One more time.
Bitcoin DEV have nothing to do with INTERNAL MtGox API ... that it "emulate" bitcoin transaction (internal balance to reduce bandwidth on bitcoin network ... and don't send the amount of bitcoin buy AND sell with a 0 INTERNAL balance at the end).

[dorobotsdream]

I haven't read this entire thread yet, but is this true? The TX ID can be modified and re-broadcast to effectively double-spend?

It's not true. Both versions of the transaction will have the same inputs, outputs and amounts; they are two different ways of expressing the same transaction, and only one will be accepted by the network, so there is no double-spend. No-one should care which version of the transaction gets accepted. (MtGox did care, and that's their mistake.)

I think this txid mutability doesn't cause double-spend by itself. But if the sender (i.e. Mt. Gox) thinks (erroneously) the coins didn't arrive because they didn't see the txid and somebody complained and they did the spend again, then it depends. If the sending address still holds enough coin, or if they use a different address then the sender does a double-spend. It could be that somebody acquired knowledge of their accounting flaw and used it to their advantage.

This is just poor bookeeping on Mt.Gox side.

If 5 BTC is sent from address X to address Y,  then it will be permanently on record in the block chain.  Does not matter which TXID was used.

That is true. But if Mt. Gox used a shortcut to finding out if THEIR transaction to Y went through by comparing txid in the blockchain with their originally created txid, then they would miss the transaction having gone through. Someone making use of this shortcut flaw (probably the one who caused the difference txid? Or could it have naturally occurred (experts?)) could have convinced Mt.Gox to then double spend.

[td services]

There is never any legitimate excuse for any financial services company to not immediately return a customer's money upon request. Mtgox has delayed customer withdrawals for almost a year now. This means Mtgox is insolvent. Do NOT keep any more money there than you are willing to lose.

[franky1]

mtgox have bitcoin on private keys... a private key is just a private key, even without a client involved the funds are on a private key.

the only code issue is with their own version of the client, which they have adapted to work with their systems autonomously

there are plenty of other client programs around to drop mtgox private keys into, and then using their own eyes to look at the database of balances, to manually repay the BTC.

i think even a 10yo could script something that looks at a database and sends info to a bitcoin client to send funds, and they would do it in under 24 hours.

[Rampion]

This is just poor bookeeping on Mt.Gox side.

This is exactly what it is. Poor bookkeeping, nothing more, nothing less.

Pretty clear to anybody with an average understanding of Bitcoin... But I have to say that I'm enjoying all this noobs with low activity screaming  and crying about Bitcoin possibly going to 0... I bet that they are the ones who sold me all those $550 coins on Bitstamp, now hoping to grab some $450 coins.

[deforme]

Worst thing is not to panic sell. Rather it is to purchase at the start of the panicking process.
MtGox manipulate the market indirectly this is so effin apparent.

or maybe getting fiat end of the panic

[franky1]

There is never any legitimate excuse for any financial services company to not immediately return a customer's money upon request. Mtgox has delayed customer withdrawals for almost a year now. This means Mtgox is insolvent. Do NOT keep any more money there than you are willing to lose.

wow.. hang on.. you must not have a bank

daily limits, AML query's and that such. look at Cyprus and other noteworthy government led bank blockages

although i morally agree that no financial service of any kind should block peoples funds... it does happen.

and i totally agree that there is no viable reason to block a bitcoin transaction, bitcoins are stored on private keys.. so blaming a protocol is simply blaming software, which can be altered/replaced

[5flags]

http://www.businessweek.com/news/2014-02-10/is-bitcoin-over-mt-dot-gox-pauses-withdrawals

Sigh

[il--ya]

It was discussed back in 2011
 https://bitcointalk.org/index.php?topic=8392.0

The patches were submitted in late 2012: https://github.com/bitcoin/bitcoin/blame/master/src/script.cpp

The protocol specification was updated in April 2011:
https://en.bitcoin.it/w/index.php?title=Protocol_specification&oldid=7624
Edited on 24 April 2011:
"Signatures use DER encoding to pack the r and s components into a single byte stream (because this is what OpenSSL produces by default). "

MtGox is a bunch of liars (should make this a signature, probably).

[callem]

Karpeles just threw bitcoin under the bus as a distraction from obvious liquidity issues at mtgox.

Rest assured that it's all FUD to those who understand the protocol, so enjoy this excellent buying opportunity while it lasts.

(just not on mtgox - the exploding Death Star of bitcoin exchanges)

[atp1916]

http://www.businessweek.com/news/2014-02-10/is-bitcoin-over-mt-dot-gox-pauses-withdrawals

Sigh

 

All of the old world institutions that worship ‎John Maynard Keynes will be shamed.

We need to amass an army of commenters at the bottom of every single article like this one to refute such foolishness with facts and history about the bitcoin network's resiliency rating.

The BTC train has already left the building.  Get on or get flattened.

[gabbello]

I think this txid mutability doesn't cause double-spend by itself. But if the sender (i.e. Mt. Gox) thinks (erroneously) the coins didn't arrive because they didn't see the txid and somebody complained and they did the spend again, then it depends. If the sending address still holds enough coin, or if they use a different address then the sender does a double-spend. It could be that somebody acquired knowledge of their accounting flaw and used it to their advantage.

+1.

If this truly happened (a lot of times) than Mt.Gox is in trouble as they double-spent the money themselves without double-checking what really happened.

However, it is funny how they managed to move the discussion in to a different direction (bug in bitcoin) instead of explaining why they stopped the withdrawals. Ok, they were using txid and their systems where not able to pick up the transactions after they sent it automatically, however why do they stop all withdraws and request a change in code of BTC and do not simply change their own code (or give a timeline how long it takes to change their code)?

[Brangdon]

I think my point was that there is not real utility in allowing a TX ID to be modified. I'd be open to hearing what I might be overlooking but at face value it seems like a very poor decision in design.

It wasn't really a design decision. Malleability is naturally allowed unless they take steps to prevent it, which they presumably didn't think was necessary at the time. Which it isn't, really. Only one transaction makes it into the block chain, and that has a single, unambiguous hash. Even now, they have taken steps to tighten it up, but it's not a priority for devs compared to more fundamental issues (like scalability).

I think this txid mutability doesn't cause double-spend by itself. But if the sender (i.e. Mt. Gox) thinks (erroneously) the coins didn't arrive because they didn't see the txid and somebody complained and they did the spend again, then it depends. If the sending address still holds enough coin, or if they use a different address then the sender does a double-spend.

That's not actually a Bitcoin double-spend, though. The second spend involves different bitcoins to the first. There are no double-spent coins in the block chain.

When you think you hold bitcoin in MtGox, you actually hold an IOU for the bitcoin, and you might be able to double-spend that IOU. That's a matter internal to MtGox. It's not a problem for the wider Bitcoin community, any more than MtGox getting hacked would be.

[Wilikon]

I haven't read this entire thread yet, but is this true? The TX ID can be modified and re-broadcast to effectively double-spend? If this is the case, not only is MtGox justified in their issues, but they've also demonstrated to the entire world how stupid this community is to believe BTC is without flaw and can't be taken to $0 if the right individuals were to go through this protocol with a fine-toothed comb. What a terrible concept to implement. What is the purpose of a TX ID if not to identify a TX? What could possibly be achieved by allowing such an ID to be modified?

Read it then.

[Mikcik]

Hmm... so Mt. Gox is clearly lying...i dont think they are stupid and that they dont realize that they ARE lying... Could this be for a reason to push down the price of BTC worldwide and buy some BTC on other exchanges to solve the BTC liquidity issue they might have? do you think this might be true?

[Kouye]

That's not actually a Bitcoin double-spend, though.

This. Quit talking about double spending, this is confusing. Notice that MtGox communication don't talk about double spend at all, either.
It's just a voluntary MtGox double send.

[gmaxwell]

Had Mt Gox been competent at all when designing their custom wallet software, they would have noted that tx-ids are mutable

You overstate your case, unless you wish to argue that Satoshi was not competent.

In any case, the reissue fraud is more or less independent of mutation.  The way you protect yourself against double payment when reissuing is that you must spend at least some of the same coins so that only one transaction or the other can get mined.  If you do this, no amount of mutation will result in funds loss (though it might confuse people!),  if you don't do this then you can still have payments doubled up even with no mutation at all.   (E.g. first payment delay, second authored, second gets confirmed, first gets rebroadcast and makes it in too).