I wanted to draw attention to a serious bug in Cryptsy's trading engine that has caused us significant losses. Cryptsy has refused to honor its published price data, and has overcharged us more than $70 in trades dating back several days. A message to Paul Vernon to correct the company's mistake has been refused even though Cryptsy itself acknowledged that there is a problem.
I represent Prohashing, a mining pool that allows users to mine any coin and receive payments in any coin. Trades are conducted through Cryptsy and, as soon as manpower is available to complete the testing of the Poloniex code, other exchanges. In August, we at Prohashing complained to Cryptsy in this forum about poor customer service. In that incident, someone (without our direction) actually went to Cryptsy headquarters with a video camera to investigate why our tickets were not being answered. Eventually Mr. Vernon showed up and apologized for a communication error, and we decided to give them a second chance since, at the time, there were mistakes in our software.
Cryptsy's documentation states that their system matches buy orders placed above the market price so that they will be executed at the market price. To place a market order and purchase coins immediately at Cryptsy, one simply enters a price above the market rate. For example, if I wanted to purchase 2 bitcoins at the current market price of $350, then I can enter an order for 2 bitcoins at $500. The order will be executed at $350, and if there aren't enough bitcoins available at that price, then at the next order at $351, and so on, until I've obtained two bitcoins or the price has climbed to $500, whichever occurs first. This behavior is consistent in both the web interface and Cryptsy's API.
Therefore, if one wants 2 bitcoins at the best possible price, one can even place an order for $999999, without actually paying $19999998. Our system takes advantage of this feature by offering to pay 1.1 times the market price, so that we receive the market rate in most cases but also limit slippage to a reasonable figure. Theoretically, as someone did in this case, a person should be able to place a sell order for a few Megacoins at 0.00000007, and the order will be executed at the highest buy price, after which it will disappear from the order book.
On Wednesday, November 19, and possibly for several days before, Cryptsy's Megacoin market contained the orders listed in
http://shoemakervillage.org/prohashing/MEC_error.jpg. The site's "push API" and the "public API" mirrored this order book. As you can see, the lowest sell order was below the highest buy order. If the system were working as advertised, this situation would not be possible. Since this data was listed as the "buy price" for Megacoins, any person or algorithm that attempted to trade Megacoins saw that the price of Megacoins was 0.00000007, since it was the lowest price.
During this time, Cryptsy allowed trades to execute against this phantom sell order. Customers who attempted to purchase Megacoins believed they were paying the low price, but they silently were charged the higher price of the second-lowest order for all their coins. If the "phantom order" were simply filled and then slippage occurred, the system would still have been incorrect, but there would have been minimal losses. Instead, anyone who traded Megacoins that day was overcharged repeatedly. They didn't know it until they looked at their account balances and noticed that they were close to zero. The "phantom order" remained on the books for the entire day (and perhaps before that) and was the published Cryptsy price no matter how many orders were placed against it.
Meanwhile, many of our customers (as well as us) noticed that Megacoins were cheap and chose to be paid in Megacoins. Since Cryptsy executed trades at the low price but delivered 1000x fewer coins than promised, nobody noticed this problem until a regular audit determined that the database balance was outside of the tolerated range from the Cryptsy expected balance. At the same time, a customer pointed out that his balance was far higher than even he expected. By the time that Megacoins were payout disabled, Cryptsy had charged us at least 0.14 bitcoins more than what we had directed them to spend for these orders.
In hopes of resolving the problem, we contacted Cryptsy through their support desk twice. We politely requested that they investigate the issue and reimburse us for the excess bitcoins, since they had advertised one price and charged another. A customer service representative acknowledged that Cryptsy was responsible for the error, and stated that they would send the issue to the "network team" for investigation. Several minutes later, the bad order was removed from Cryptsy's system, as shown in the huge crash in
http://shoemakervillage.org/prohashing/MEC_error2.jpg. We submitted a reply explaining that a store cannot advertise one price, charge another, and then refuse to correct the difference, and asked for the issue to be escalated to a supervisor or directly to Mr. Vernon. Instead, Cryptsy replied with the following response:
Unfortunately our terms of service state that we do not endorse , nor can we be responsible for the use of 3rd party content ie: If you were not using the automated trading software which is not endorsed by cryptsy, im sure the trades would not have been placed. Wish i could do more to assist you, but there is not much more I can do about these types of situations.
Sincerely, Jim aka: JShock Customer Service Manager Cryptsy.com
Keep in mind that there was no "third party content" being used here. The content (price data) was obtained directly from Cryptsy's website. No additional sources of information were used in making trading decisions. Furthermore, humans using Cryptsy's website would also fall victim to the same issue, as would an API trading program created by Cryptsy's own engineers.
To review, imagine that you walk into a hardware store and see that there is a sale on a type of screw. You take the screws to the cashier and since they are so cheap, you say that you're even willing to pay 1.1 times the sale price. Since the cost is so low, you buy 10,000 of these 5 cent screws to use in building your new home. The cashier tells you that paying more than the sale price isn't necessary, and that the store will just charge the normal price, so you give the cashier a credit card. The card rings through at the agreed price, and you leave. After a long day of using up all the screws to install drywall, you return from the job site and log onto your bank's website to balance your budget. You discover that, instead of paying $500.00 for all the screws, you were actually charged a half million dollars for a few dozen boxes of fasteners. You call the company to complain and correct the error, but they refuse, saying that the cost was actually 1000 times greater and they were passing on the error to you. After all, it was your fault that you relied on the price they listed on the shelf when you decided how many screws to purchase.
We refuse to pass such losses onto our customers, so I withdrew money from my personal account to cover them. The problem we face is that mining is an industry dominated by liars, cheats, and frauds. I hear stories from people who talk about companies like the Middlecoin pool, where h2odyssey claimed that BTC-e froze over 50 bitcoins and he just decided to disappear. The number one problem we have to deal with every day is customers who refuse to do business with us not because we have ever cheated them, but because every other mining company they have dealt with has ripped them off. It is extremely difficult to run a business that actually stands by its commitments when people have come to expect everyone else to cheat them. However, despite honoring our own commitment, we have made it clear to our customers that Cryptsy is not honoring theirs.
There is something deeply wrong when a startup pool that is just registering as a company pays out others' problems from personal funds, and a corporation with an actual office, many employees, and which is registered as a FinCEN money transmitter passes losses from its own bugs to its customers.
If Mr. Vernon reads this post, then I hope that he does the right thing by apologizing for what Cryptsy has already acknowledged as a mistake, and adding the correct number of bitcoins to reimburse the account balances of everyone affected by this bug. If he chooses not to do so, then his negative business practices have proven that Cryptsy is little better than the dishonest companies in the bitcoin industry.
Poll
