Gox withdrawal malleability issue

[bito]

Firstly, tying the original posting of the gmaxwell IRC comment on goxes automatic reissues, to the "greater context".

Today on #bitcoin

gmaxwell: wumpus: yea, I understand they had timed automatic reissues... this was also something I didn't know prior to monday before last and is one of the other reasons my "they couldn't have lost much!" position softened to "I have no freeking clue."
alpha125: gmaxwell: where did you find out abotu the automatic reissues?
gmaxwell: alpha125: from mtgox staff and magicaltux ... I had assumed previously that any reissues were manual via customer support but apparently it was just timed.
gmaxwell: you'll also note that they've kept increasing their fees and then even mad paying fees mandatory.
gmaxwell: This suggested to me that they totally misunderstood their problems. (and— I reported that I believed this months ago too)
gmaxwell: e.g. they noticed lots of txn getting stuck, they didn't understand it was because they were producing invalid txn (even though it was reported to them) and so they thought it was just 'full blocks'
gmaxwell: and they increased their fees from 0.0001 to 0.0005 — which was enough to may more than virtually every txn— and then later to 0.001 which is basically astronomic. And then they made it mandatory.
gmaxwell: of course their stalled txn had nothing to do with fees.

Edit: Just to clarify, only quoted relevant parts (maybe I should have inserted "[...]" where applicable). Full text here: http://pastebin.com/DaSph9uT

That pastebin was taken completely out of context. The user on here who posted it also apologised to gmaxwell on IRC for posting it

As I said earlier on IRC, I did not mean to step on anyone's toes, especially not gmaxwell's. I had no context, since I joined the channel just moments before. I did just mean to provide information and don't have any $/BTC on Gox. Didn't mean to spread FUD/fear and have no agenda, the post was meant to be informative in nature only.

Should there be any relevant context, that changes the perceived meaning, someone please post it.

Seriously, don't apologize.

I mean, what the hell? If it's on IRC, you're free to show it to the rest of the world, simple as that. And "lack of context"? What the fuck. It's a pretty long log, so it's hardly a single line or two "taken out of context".

Really, if you submitted that log, thanks!

As said on IRC, that was my initial thinking, too. It seemed some didn't agree and I just meant to highlight that I intended no harm or offense.

About context one thing that could potentially be interesting is what gmaxmell is replying to (he's addressing wumpus). Maybe someone can add that who has been in the channel a little earlier than me?

These are the only posts I have from after I joined the channel, before my infamous quote, I cut them since I considered them not relevant:

#bitcoin: The topic for #bitcoin is: v0.8.6 | Bitcoin: http://www.weusecoins.com | https://en.bitcoin.it/wiki/FAQ | Let's discuss bitcoin--ALTCOINS ARE OFF-TOPIC | Prices: #bitcoin-pricetalk Trading: #bitcoin-otc News: #bitcoin-news MtGox: #mtgox | Rules: http://bit.ly/qNzg3P | DON'T use web wallets! | URLs may be coin-stealing malware! | Unsolicited PMs may be scammers! | NO URLs OR BEGGING
#bitcoin: Topic for #bitcoin set by jcorgan!~jcorgan@unaffiliated/jcorgan at 12:13:13 AM on 2/6/2014
epscy: mrkent: impossible to know but yeah
Snowleaksange: its smush-likely
AnonX left the room (quit: Read error: Connection reset by peer).
Mike3620 [~Mike3620@unaffiliated/mike3620] entered the room.
epscy: mrkent: most people are assuming that if they lost a significant amount of btc they would be able to cover the loss with their btc profit (which is assumed to be substantial)

The pastebin from earlier starts right after those.

How long the above rumor has been circulating who knows, it would explain the transition from goxbtc going from a premium to a discount two weeks ago. That much makes sense.

But what does not make sense is if withdrawals were automatically reissued, then doesn't that mean everyone would be getting a double credit to their wallet, malicious users and innocent benefactors combined?

Call me old fashioned but I find it hard to believe that nobody who was the unintentional recipient of a double credit in the last few months didn't mention this to gox. It's been going on for a while and not everyone is dishonest. And what about all the posts from gox customers saying they didn't get their btc? Were those users lying?

What am I missing?

Please refrain from goxsux and markhurt comments.

[LarryLiu]

Even this "Timed Automatic Reissue" was true, it was still not that easy and simple for them to lose any significant amount of bitcoins. Here are the reasons:

1. There has always been a daily limit on the number of bitcoins that a customer can initiate to withdraw on.
2. When Gox's system reissues the TX, was it resubmitting the failed TX to the network or was it re-creating a new transaction from a wallet that had excessive amount of founds.
3. Let's assume it was the later case from the above, which is worse, it wouldn't still be easy for the attacker(s) to pull everything off that easily. He/she would have to be able to monitor the relevant TX (at a sweat spot on the network) and propagate a recasted version of it quickly enough to the majority of the network's mining rigs. If the attacker was indiscriminately recasting all TXs, yes some innocent Gox customers should have gotten doubled/tripled deposits as well.
4. If Gox was using TIMED retries, it would have further limited the attacher's opportunities for continuous retries.

I have been observing the situation as well as the market itself since the whole fiasco started couple weeks ago. I'd like to say to every Gox customer, this is the time you don't want to be sold on any non-factial information or speculation. If Gox announces bankruptcy (which is not very likely) using the loss of btc as the reason, the public especially Gox customers MUST DEMAND Gox to provide all relevant transactions information to substantiate such claim. Remember such information is easy to verify but almost impossible to fabricate thank to the public blockchain, unless someone planned them ahead of time.