Exchange Development

[AllenWatson]

White-Label vs. Building Your Crypto Exchange from scratch- what would you prefer?

[1715255479]

1715255479

[1715255479]

1715255479

[1715255479]

1715255479

[1715255479]

1715255479

[OmegaStarScream]

I wouldn't suggest white-labeling, at least not in the crypto exchange field. Even though there will be no struggle as these products are usually easy to deploy, you will find a hard time with both support and most importantly, the customization of your exchange, not to mention that in most cases, you have to pay in an annual/monthly basis.

Open source products are out of the question as well (If you don't have the necessary knowledge), you don't know If these are secure enough and whether they contain backdoors or not.

Building your own exchange and hiring the right team might be time consuming and hard, but If done right, it would be very profitable. But again, If one is serious about running a business, no shortcuts should be used.

[mk4]

Basically anything could probably work out well in the end if you hire the right developers. If I remember correctly, I think I've read somewhere in the past that Binance didn't build their exchange software from the ground up. Instead, they bought an already-made software and just simply tweaked it a lot from there; and look at them now. One beast of an exchange.

[AllenWatson]

I wouldn't suggest white-labeling, at least not in the crypto exchange field. Even though there will be no struggle as these products are usually easy to deploy, you will find a hard time with both support and most importantly, the customization of your exchange, not to mention that in most cases, you have to pay in an annual/monthly basis.

Open source products are out of the question as well (If you don't have the necessary knowledge), you don't know If these are secure enough and whether they contain backdoors or not.

Building your own exchange and hiring the right team might be time consuming and hard, but If done right, it would be very profitable. But again, If one is serious about running a business, no shortcuts should be used.

Thank you for sharing your views. But crypto market is highly volatile and I've heard many people say that having a market ready solution could help benefit from favorable market conditions.

[pooya87]

Open source products are out of the question as well (If you don't have the necessary knowledge), you don't know If these are secure enough and whether they contain backdoors or not.

using open source software is never about "you" personally having the skills to review it. nobody has the time. for example we are using bitcoin-core but most of us might not even have looked at the source code. the point of open source is that the source is open for everyone to see and if the project is popular enough you can be sure that others have reviewed it specially if it is sensitive and deals with lots of money, and then you can trust it doesn't have any backdoors.

[bob123]

using open source software is never about "you" personally having the skills to review it.

Actually.. in this case, where one wants to build an exchange.. it is.
Either you or some payed security expert has to review it.

the point of open source is that the source is open for everyone to see and if the project is popular enough you can be sure that others have reviewed it specially if it is sensitive and deals with lots of money, and then you can trust it doesn't have any backdoors.

Just because some open-source exchange doesn't have a sendPrivatekeysToServer() function, it doesn't mean that there is no backdoor.

Do you think you (or one of the 100 others who liked/forked such an open-source exchange) do have an excellent clue about IT security ?
Do you really think they would find a vulnerability which has been placed on purpose ?

I mean.. hell.. OpenSSL has been reviewed by countless people.. still it took more than 3 years to find heartbleed.
One of the most obvious vulnerabilities (after the discovery).

Some well-hidden vulnerability definitely won't be found by some simple code reviews.


The other question is.. why open-source an exchange if you can earn multiple 100k dollars with it when done right (not talking about running an exchange, but selling the software) ?
What's their business model? Giving aways valuable software for free because why not?



IMO, if someone wants to run an exchange.. invest multiple 10k's or 100k's of $ into a good software, get some professional security consultants and perform regular penetration tests.

[pooya87]

using open source software is never about "you" personally having the skills to review it.

Actually.. in this case, where one wants to build an exchange.. it is.
Either you or some payed security expert has to review it.

well, every project starts from somewhere. bitcoin wasn't this trusted or even secure when it first came out. bitcoin-QT (now known as bitcoin-core) had many bugs in it and after years if reviewing got fixed. and at first there weren't really that many even looking at the code!

the point of open source is that the source is open for everyone to see and if the project is popular enough you can be sure that others have reviewed it specially if it is sensitive and deals with lots of money, and then you can trust it doesn't have any backdoors.

Just because some open-source exchange doesn't have a sendPrivatekeysToServer() function, it doesn't mean that there is no backdoor.

Do you think you (or one of the 100 others who liked/forked such an open-source exchange) do have an excellent clue about IT security ?
Do you really think they would find a vulnerability which has been placed on purpose ?
[/quote]
we can't put aside open source (decentralized) exchanges just because of a possibility of them not being reviewed by experts at first. the alternative is closed sourced centralized exchanges that are getting hacked every day!

I mean.. hell.. OpenSSL has been reviewed by countless people.. still it took more than 3 years to find heartbleed.
One of the most obvious vulnerabilities (after the discovery).
Some well-hidden vulnerability definitely won't be found by some simple code reviews.

now that is a different discussion. there is a difference between having a bug (which is normal and literary any code that has ever been written has them) and [intentional] backdoors put in the code with malicious intent.

The other question is.. why open-source an exchange if you can earn multiple 100k dollars with it when done right (not talking about running an exchange, but selling the software) ?
What's their business model? Giving aways valuable software for free because why not?

such projects usually work on donations, fund raising,... and remain open. and generally speaking the open source community doesn't work for money and is the contribution of many developers to one project.
i'd personally donate a good amount to a decentralized open source exchange if i can find a good one not to mention i would contribute to the code itself as i have done to many other open source projects.

[bob123]

we can't put aside open source (decentralized) exchanges just because of a possibility of them not being reviewed by experts at first. the alternative is closed sourced centralized exchanges that are getting hacked every day!

The problem is that not even reviewing them guarantees you to have a secure software.
It is way easier to build the software from scratch with security in mind, than to adapt a different one and review/fix it.

The fact that even closed source exchanges are getting hacked (which have professional security audits and code being written with security in mind - at least talking about the big ones), is an additional argument AGAINST using software which did not have any audits at all and without having a highly professional security-orientated development team working on it.


Don't get me wrong. I fully support open-source. I use it wherever possible.
But if i would be running such a business, i'd rather pay a lot of money for a proper (and secure) software, instead of trying to save at this place.

now that is a different discussion. there is a difference between having a bug (which is normal and literary any code that has ever been written has them) and [intentional] backdoors put in the code with malicious intent.

How do you define backdoor ?
If your only definition is a true 'backdoor' (i.e. malicious person can gain access from outside), then yes. This could be found.

However, a maliciously intended vulnerability (maybe even in the design of the software which isn't recognizable at the first sight) won't be found in some 'standard security-orientated review'.


IMO the risk is way too high.

[pooya87]

~
The problem is that not even reviewing them guarantees you to have a secure software.
It is way easier to build the software from scratch with security in mind, than to adapt a different one and review/fix it.

The fact that even closed source exchanges are getting hacked (which have professional security audits and code being written with security in mind - at least talking about the big ones), is an additional argument AGAINST using software which did not have any audits at all and without having a highly professional security-orientated development team working on it.

the exchange hack cases that i know of have never been because of a security flaw in their systems. it was always because of human mistakes. for example inside jobs, an incompetent employee, not securing the hot wallet properly,... and they all had highly professional developers working on their software or at least they claimed to.

Don't get me wrong. I fully support open-source. I use it wherever possible.
But if i would be running such a business, i'd rather pay a lot of money for a proper (and secure) software, instead of trying to save at this place.

i get your point and for something that is supposed to handle this much money it is mandatory for the software to be audited by security professionals but i still prefer open source software because the closed source one is audited by one person/team while the open source one can be audited by thousands and they usually are (the popular ones anyways).

How do you define backdoor ?
If your only definition is a true 'backdoor' (i.e. malicious person can gain access from outside), then yes. This could be found.

actually i define backdoor as a vulnerability that was put there by the developer himself with malicious intent. if it wasn't intentional i call it a bug.

[bob123]

the exchange hack cases that i know of have never been because of a security flaw in their systems.

Exhibit 1: Bitgrail - 170M $

They had a vulnerability which allowed people to withdraw funds they did not have. A lot of ETH and NANO have been stolen this way.
The extremely embarrassing mistake which lead to that was that sanity checks have been handled client-side (javascrit; LOL).


Exhibit 2: GateHub - 10M $

The attacker gained person to a database holding (valid) API tokens of their customer.
These have been used to withdraw funds.


Exhibit 3: Bitfinex - 72M $ (120K BTC at that time)

Bitfinex hat a flaw in the design of their system.
They were using multisig wallets in cooperatin with Bitgo as a co-signer.
Unfortunately, the Bitgo server basically signed whatever bitfinex wanted to be signed.
Once an attacker gained access to the bitfinex server, he let 1) bitfinex sign a transaction and 2) told bitgo to co-sign it from the bitfinex server.


And these 3 are definitely not all cases where security flaws in the technology and the system-design were the reason for funds being stolen.

[...] but i still prefer open source software because the closed source one is audited by one person/team while the open source one can be audited by thousands and they usually are (the popular ones anyways).

The problem is that auditing can never find all technical- and design flaws.
The software has to be built with security in mind - from the beginning.

'Implementing' security afterwards, almost always goes wrong.