[ANN] SpreadCoin | True Decentralization (No Pools) | Testing New Masternodes

[e1ghtSpace]

I personally find this graph a tiny bit confusing. IMO it makes a lot morse sense if we use the old one but say "Reward over 10 minutes" instead of just "Reward" (for the Y axis).

Maybe "block reward" would be more appropriate name?

Well, the first time I saw the graph it confused me because the block times are different. That's why I think it makes sense to say "over 10 minutes" because 6.66 isn't bigger than 50 but on the graph it looks like it is.

[1713855736]

1713855736

[1713855736]

1713855736

[RawrRawr]

Thank you, guys. If it will work, I`ll spend some of this coins for voting on askcoin, for example.

[e1ghtSpace]

Sorry but it looks like your coins are gone.  



I'm really sorry about this.

[MyFarm]

RawrRawr how many coins did you lose?  Do you have any left?

[e1ghtSpace]

RawrRawr how many coins did you lose?  Do you have any left?

I think he has at least 2.5k left. He lost 3K. You can see in the blockchain explorer.

[Mr. Spread]

Mr.spread,what's status of masternode and darksend developmnet?

It is far from ready yet but I think I found a potential vulnerability in DarkCoin which allows miners (actually pools) to not pay part of the block reward to masternodes.
DarkCoin wallet checks the following things for each new block:  
1) There is a payment to master node.
2) There is a payment with the same amount as a payment to master node should be (30%).
But there is no check that this is the same payment. This means that if you generate a block you can pay 0.0000001 DRK to masternode and pay 30% and (70% - 0.0000001 DRK) to yourself as separate coinbase outputs. Such blocks should be accepted by DarkCoin network but I haven't tested it on testnet so I can't be 100% sure.

[MyFarm]

Mr. Spread, have you found the part of the Darkcoin code where, "Enforcement" is on or off?  I THINK that may be what you're seeing as when enforcement is off, yes, that can and has happened.

And have you notified the Darkcoin developer, Evan Duffield?

[e1ghtSpace]

Mr.spread,what's status of masternode and darksend developmnet?

It is far from ready yet but I think I found a potential vulnerability in DarkCoin which allows miners (actually pools) to not pay part of the block reward to masternodes.
DarkCoin wallet checks the following things for each new block:  
1) There is a payment to master node.
2) There is a payment with the same amount as a payment to master node should be (30%).
But there is no check that this is the same payment. This means that if you generate a block you can pay 0.0000001 DRK to masternode and pay 30% and (70% - 0.0000001 DRK) to yourself as separate coinbase outputs. Such blocks should be accepted by DarkCoin network just fine but I haven't tested it on testnet to be 100% sure.

Awesome! (if the vulnerability works) We can be the first coin to have the masternode vulnerability fixed!

edit;

Mr. Spread, have you found the part of the Darkcoin code where, "Enforcement" is on or off?  I THINK that may be what you're seeing as when enforcement is off, yes, that can and has happened.

Awww.

[MyFarm]

Mr.spread,what's status of masternode and darksend developmnet?

It is far from ready yet but I think I found a potential vulnerability in DarkCoin which allows miners (actually pools) to not pay part of the block reward to masternodes.
DarkCoin wallet checks the following things for each new block:  
1) There is a payment to master node.
2) There is a payment with the same amount as a payment to master node should be (30%).
But there is no check that this is the same payment. This means that if you generate a block you can pay 0.0000001 DRK to masternode and pay 30% and (70% - 0.0000001 DRK) to yourself as separate coinbase outputs. Such blocks should be accepted by DarkCoin network just fine but I haven't tested it on testnet to be 100% sure.

Awesome! (if the vulnerability works) We can be the first coin to have the masternode vulnerability fixed!

While I understand your perspective, it my opinion, it would be wrong not to notify the Darkcoin dev of any potential vulnerabilities.

[e1ghtSpace]

Mr.spread,what's status of masternode and darksend developmnet?

It is far from ready yet but I think I found a potential vulnerability in DarkCoin which allows miners (actually pools) to not pay part of the block reward to masternodes.
DarkCoin wallet checks the following things for each new block:  
1) There is a payment to master node.
2) There is a payment with the same amount as a payment to master node should be (30%).
But there is no check that this is the same payment. This means that if you generate a block you can pay 0.0000001 DRK to masternode and pay 30% and (70% - 0.0000001 DRK) to yourself as separate coinbase outputs. Such blocks should be accepted by DarkCoin network just fine but I haven't tested it on testnet to be 100% sure.

Awesome! (if the vulnerability works) We can be the first coin to have the masternode vulnerability fixed!

While I understand your perspective, it my opinion, it would be wrong not to notify the Darkcoin dev of any potential vulnerabilities.

Yeah, I know.
Maybe he can say "Vulnerability found by SpreadCoin Dev" or something.

[cyptohunter]

Mr.spread,what's status of masternode and darksend developmnet?

It is far from ready yet but I think I found a potential vulnerability in DarkCoin which allows miners (actually pools) to not pay part of the block reward to masternodes.
DarkCoin wallet checks the following things for each new block:  
1) There is a payment to master node.
2) There is a payment with the same amount as a payment to master node should be (30%).
But there is no check that this is the same payment. This means that if you generate a block you can pay 0.0000001 DRK to masternode and pay 30% and (70% - 0.0000001 DRK) to yourself as separate coinbase outputs. Such blocks should be accepted by DarkCoin network but I haven't tested it on testnet so I can't be 100% sure.

GREAT!
MR.spread is a excellent Dev,not merely a clone of source code,but discover the bug and improve it  

[Mr. Spread]

Sorry but it looks like your coins are gone.  



I'm really sorry about this.

Not necessarily, while address format is the same, private key format is different, it is necessary to convert it, I will try to do it.

[e1ghtSpace]

Sorry but it looks like your coins are gone.  



I'm really sorry about this.

Not necessarily, while address format is the same, private key format is different, it is necessary to convert it, I will try to do it.

Ah, I was hoping something like this would be the case. You are a great dev Mr. Spread.

[Mr. Spread]

Mr. Spread, have you found the part of the Darkcoin code where, "Enforcement" is on or off?  I THINK that may be what you're seeing as when enforcement is off, yes, that can and has happened.

And have you notified the Darkcoin developer, Evan Duffield?

It is in the code that checks that payments are correct if they are enforced, more specifically it is in these lines: https://github.com/darkcoin/darkcoin/blob/master/src/main.cpp#L2822
I found it about half an hour ago and haven't yet notified anyone from Darkcoin team. This probably is bad, I should think better next time and contact dev first.
I'm still not 100% sure if it is a bug, maybe all the necessary checks are performed somewhere else but I didn't find any other checks.

[RawrRawr]

Not necessarily, while address format is the same, private key format is different, it is necessary to convert it, I will try to do it.

Oh, you are truly great dev. I wrote to C-CEX, and I wait for the answer.

[MyFarm]

Mr. Spread, have you found the part of the Darkcoin code where, "Enforcement" is on or off?  I THINK that may be what you're seeing as when enforcement is off, yes, that can and has happened.

And have you notified the Darkcoin developer, Evan Duffield?

It is in the code that checks that payments are correct if they are enforced, more specifically it is in these lines: https://github.com/darkcoin/darkcoin/blob/master/src/main.cpp#L2822
I found it about half an hour ago and haven't yet notified anyone from Darkcoin team. This probably is bad, I should think better next time and contact dev first.
I'm still not 100% sure if it is a bug, maybe all the necessary checks are performed somewhere else but I didn't find any other checks.

I see.  And yes, I'd contact the Darkcoin dev privately first in the future.  

[Mr. Spread]

Sorry but it looks like your coins are gone.  



I'm really sorry about this.

Not necessarily, while address format is the same, private key format is different, it is necessary to convert it, I will try to do it.

Ah, I was hoping something like this would be the case. You are a great dev Mr. Spread.

I successfully converted this private key to SpreadCoin format and now I can steal your 0.16 SPR

Not necessarily, while address format is the same, private key format is different, it is necessary to convert it, I will try to do it.

Oh, you are truly great dev. I wrote to C-CEX, and I wait for the answer.

If they will give you this private key you can send it to me if you trust me and I will send these coins to your new address. If you don't trust me this will complicate things but we can still figure out how to return these coins back to you.

[e1ghtSpace]

Sorry but it looks like your coins are gone.  



I'm really sorry about this.

Not necessarily, while address format is the same, private key format is different, it is necessary to convert it, I will try to do it.

Ah, I was hoping something like this would be the case. You are a great dev Mr. Spread.

I successfully converted this private key to SpreadCoin format and now I can steal your 0.16 SPR  

Nooooo!!!!!  

Nice job.

Edit:
What is the private key? (you can post it here for people to steal)

[antonio8]

What is this other coin? Maybe it uses the same address format as SpreadCoin.

epic fail.

You need to contact C-CEX and ask them for private key corresponding to this address. Then you will need to import this key into your SpreadCoin wallet but I'm not sure if this will actually work.

They are going to ask for 0.5 BTC to correct the problem.

I am following/mining another coin where someone has the same issue.

[RawrRawr]

If they will give you this private key you can send it to me if you trust me and I will send these coins to your new address. If you don't trust me this will complicate things but we can still figure out how to return these coins back to you.

Dude, I trust you more than Jesus.