SatoshiDICE.com - The World's Most Popular Bitcoin Game

[avicii123]

Well this is a pretty big exploit, i could exploit it myself and make a lot of BTC, but i rather do the right thing and report it, since many other websites offer rewards for bugs, i think i should deserve 1 aswell, if satoshidice agrees to pay reward i will provide full information on how the bug appears and how it can be solved.

Appreciate your decision and yes I agree you deserve a big bug reward if the problem can be reproduced to make double withdrawals. But I don't know if SD will consider it a big exploit and offer bounty for it.
In fact, dooglus was having some little conflicts with PRC Dice just a few days earlier because of a bug reward.

Yeah, im just surprised that satoshidice doesn't even care about it, since they haven't replied to my email for over 2 weeks now

[1714159017]

1714159017

[1714159017]

1714159017

[1714159017]

1714159017

[coincolonel]

Well this is a pretty big exploit, i could exploit it myself and make a lot of BTC, but i rather do the right thing and report it, since many other websites offer rewards for bugs, i think i should deserve 1 aswell, if satoshidice agrees to pay reward i will provide full information on how the bug appears and how it can be solved.

Appreciate your decision and yes I agree you deserve a big bug reward if the problem can be reproduced to make double withdrawals. But I don't know if SD will consider it a big exploit and offer bounty for it.
In fact, dooglus was having some little conflicts with PRC Dice just a few days earlier because of a bug reward.

Yeah, im just surprised that satoshidice doesn't even care about it, since they haven't replied to my email for over 2 weeks now

Why is this satoshidice, a site with years of experience still has this kind of bugs

[SatoshiDICE_PR]

There is something wrong when I want to set my bet by changing the "Roll Under to Win".

If I set the "Win Chance" to 93.079%, the "Roll Under to Win" will be calculated correctly to be 61000.
If I set the "Roll Under to Win" to 61000, the field will change to 0 automatically and my bet will fail with a warning "belowRollToWin Is Too Small".

I see the same bug.

Also, my balance is -0.00010007 (negative). I only referred one player (myself) and he hasn't played since the referral system was changed to stop making immediate payouts. My negative balance was cleared by my winning a 1.25 BTC daily leaderboard prize - so why's it negative again now? I'm pretty sure that's the amount I was down before, but I already paid that debt from my win.

Hello, this is because we disabled so that the revenue share from affiliated players were not reflected in the balance any more. We then made the decision to activate this code again. This is because we had to disable the affiliate system but we don't want to take any affiliate's revenue share. So basically, you have a negative revenue share of 0.00010007 that was not visible before.

New affiliates are not given an affiliate link (for now). When we activate the affiliate system again, affiliates will instead get a small percentage of the bet amount that affiliated players make.

[shitaifan2013]

this is going to end in complete chaos 

[SatoshiDICE_PR]

There is something wrong when I want to set my bet by changing the "Roll Under to Win".

If I set the "Win Chance" to 93.079%, the "Roll Under to Win" will be calculated correctly to be 61000.
If I set the "Roll Under to Win" to 61000, the field will change to 0 automatically and my bet will fail with a warning "belowRollToWin Is Too Small".

I see the same bug.

Also, my balance is -0.00010007 (negative). I only referred one player (myself) and he hasn't played since the referral system was changed to stop making immediate payouts. My negative balance was cleared by my winning a 1.25 BTC daily leaderboard prize - so why's it negative again now? I'm pretty sure that's the amount I was down before, but I already paid that debt from my win.

Hey, dooglus i found a big exploit on satoshidice which results in double cashout and negative balance, i know what causes it and i only exploited it once (unintentionally) and i tried reporting it to satoshidice , but they never responded to my email , could you contact them regarding this? i would be willing to share my informaiton for some kind of Reward.

At the time we received your email, we had already corrected this. The code that is disabling parallel execution of withdrawals was unfortunately not activated on the live site (but it is now). Thanks for reporting the problem!

[avicii123]

There is something wrong when I want to set my bet by changing the "Roll Under to Win".

If I set the "Win Chance" to 93.079%, the "Roll Under to Win" will be calculated correctly to be 61000.
If I set the "Roll Under to Win" to 61000, the field will change to 0 automatically and my bet will fail with a warning "belowRollToWin Is Too Small".

I see the same bug.

Also, my balance is -0.00010007 (negative). I only referred one player (myself) and he hasn't played since the referral system was changed to stop making immediate payouts. My negative balance was cleared by my winning a 1.25 BTC daily leaderboard prize - so why's it negative again now? I'm pretty sure that's the amount I was down before, but I already paid that debt from my win.

Hey, dooglus i found a big exploit on satoshidice which results in double cashout and negative balance, i know what causes it and i only exploited it once (unintentionally) and i tried reporting it to satoshidice , but they never responded to my email , could you contact them regarding this? i would be willing to share my informaiton for some kind of Reward.

At the time we received your email, we had already corrected this. The code that is disabling parallel execution of withdrawals was unfortunately not activated on the live site (but it is now). Thanks for reporting the problem!

I have tested it today, the bug still seems to be working

[SatoshiDICE_PR]

There is something wrong when I want to set my bet by changing the "Roll Under to Win".

If I set the "Win Chance" to 93.079%, the "Roll Under to Win" will be calculated correctly to be 61000.
If I set the "Roll Under to Win" to 61000, the field will change to 0 automatically and my bet will fail with a warning "belowRollToWin Is Too Small".

I see the same bug.

Also, my balance is -0.00010007 (negative). I only referred one player (myself) and he hasn't played since the referral system was changed to stop making immediate payouts. My negative balance was cleared by my winning a 1.25 BTC daily leaderboard prize - so why's it negative again now? I'm pretty sure that's the amount I was down before, but I already paid that debt from my win.

Hey, dooglus i found a big exploit on satoshidice which results in double cashout and negative balance, i know what causes it and i only exploited it once (unintentionally) and i tried reporting it to satoshidice , but they never responded to my email , could you contact them regarding this? i would be willing to share my informaiton for some kind of Reward.

At the time we received your email, we had already corrected this. The code that is disabling parallel execution of withdrawals was unfortunately not activated on the live site (but it is now). Thanks for reporting the problem!

I have tested it today, the bug still seems to be working

Well you can execute several withdrawals simultaneously, as long as you have balance available for each withdrawal. What you can't do for the last few days is to bring the account into negative balance.

[dooglus]

my balance is -0.00010007 (negative). I only referred one player (myself) and he hasn't played since the referral system was changed to stop making immediate payouts. My negative balance was cleared by my winning a 1.25 BTC daily leaderboard prize - so why's it negative again now? I'm pretty sure that's the amount I was down before, but I already paid that debt from my win.

So basically, you have a negative revenue share of 0.00010007 that was not visible before.

That isn't true. It was visible before, and I paid it off out of my winnings. I even posted a screenshot of it!

I'm not making things up. What I wrote above is true. I had a negative balance, paid it off, and now you've made it negative again, effectively charging me twice for the same winnings.

Here's my initial post about the same negative balance:

The most interesting feature ever.

It seems to suffer from rounding errors too.

"testing" won 1000 satoshis, causing "dooglus" to lose 100 satoshis from his positive balance. "dooglus" then gambled his balance and kept going all-in until it was zero. The "testing" won 99094 more satoshis, making a total profit of 100094 satoshis. At that point "dooglus" balance should have been -9909 satoshis, but it's only -9907 - so two satoshis were lost somewhere.

I guess it doesn't matter, but it does suggest that affiliate payments aren't being calculated correctly.

Edit: dooglus' affiliate page agrees with my record of testing's profit:



but dooglus' balance doesn't (I would expect it to be 100 satoshis more than -0.00010009 BTC, or -0.00009909 BTC):

[Dabs]

I have tested it today, the bug still seems to be working

avicii123, do it. Go grab a few BTC. Then show proof. Explain. Reproduce. Then, return back the BTC you got that you know is not yours. SD should then acknowledge your bug, and they should offer a bounty. But do not hold their BTC hostage, return it in full (except your own deposit of course).

If you can successfully withdraw 10 BTC for example, and return it (or hold it), then I see no reason why SD should not accept 9.9 BTC back. Or whatever bug bounty you guys agree on.

Just my opinion.

Large companies tend not to do any actions until exploits have actually been executed.

[King Agamemnon]

this is going to end in complete chaos 

I love to see whats coming. Fcking up dooglus is  not a good idea. Come Just-Dice, what do you have?

[SatoshiDICE_PR]

my balance is -0.00010007 (negative). I only referred one player (myself) and he hasn't played since the referral system was changed to stop making immediate payouts. My negative balance was cleared by my winning a 1.25 BTC daily leaderboard prize - so why's it negative again now? I'm pretty sure that's the amount I was down before, but I already paid that debt from my win.

So basically, you have a negative revenue share of 0.00010007 that was not visible before.

That isn't true. It was visible before, and I paid it off out of my winnings. I even posted a screenshot of it!

I'm not making things up. What I wrote above is true. I had a negative balance, paid it off, and now you've made it negative again, effectively charging me twice for the same winnings.

Here's my initial post about the same negative balance:

The most interesting feature ever.

It seems to suffer from rounding errors too.

"testing" won 1000 satoshis, causing "dooglus" to lose 100 satoshis from his positive balance. "dooglus" then gambled his balance and kept going all-in until it was zero. The "testing" won 99094 more satoshis, making a total profit of 100094 satoshis. At that point "dooglus" balance should have been -9909 satoshis, but it's only -9907 - so two satoshis were lost somewhere.

I guess it doesn't matter, but it does suggest that affiliate payments aren't being calculated correctly.

Edit: dooglus' affiliate page agrees with my record of testing's profit:



but dooglus' balance doesn't (I would expect it to be 100 satoshis more than -0.00010009 BTC, or -0.00009909 BTC):

Also, my balance is -0.00010007 (negative). I only referred one player (myself) and he hasn't played since the referral system was changed to stop making immediate payouts. My negative balance was cleared by my winning a 1.25 BTC daily leaderboard prize - so why's it negative again now? I'm pretty sure that's the amount I was down before, but I already paid that debt from my win.

Sorry I didn't intend to say that you were making things up... you are right that your account displayed a negative balance even earlier. If paid off to zero, it would then show a positive balance when we disabled affiliate earnings entirely (not counting the negative earnings anymore). This is the point in time where I meant that your account wouldn't show a negative. If your account were then brought to a zero balance (from betting or withdrawing) before we activated the affiliate earnings again, this would bring your account back into a negative. I think this is what happened and nobody was charged twice (but it may have appeared like this)... The database remained unchanged the whole time.

dooglus account:
Revenue share "penalty": 29696 satoshis
Revenue share "reward": 19689 satoshis

end result: -10007 satoshis

"Penalties" and "rewards" are rounded down (no such thing as 0.5 satoshis!) and given out when each roll is completed (hence the real time affiliate earnings). This is causing a possible difference between the number of satoshis displayed on the affiliate stats page because this page instead takes the sum of bets from each referred player's bet history. We will correct this so that the affiliate stats page reports the true earnings.

[SatoshiDICE_PR]

I have tested it today, the bug still seems to be working

avicii123, do it. Go grab a few BTC. Then show proof. Explain. Reproduce. Then, return back the BTC you got that you know is not yours. SD should then acknowledge your bug, and they should offer a bounty. But do not hold their BTC hostage, return it in full (except your own deposit of course).

If you can successfully withdraw 10 BTC for example, and return it (or hold it), then I see no reason why SD should not accept 9.9 BTC back. Or whatever bug bounty you guys agree on.

Just my opinion.

Large companies tend not to do any actions until exploits have actually been executed.

This issue has been fixed. Over these last couple of days there's been around a hundred attempts to make parallel withdrawals and they were all executed normally (denying the excess ones if they would have given the account a negative balance).

We can't stop people from trying but the only thing they are likely to accomplish is to lose the 0.0001 transaction fees.

[God]

this is going to end in complete chaos  

I love to see whats coming. Fcking up dooglus is  not a good idea. Come Just-Dice, what do you have?

dooglus said he won the 1.25 btc leader board reward from the free 0.01 promotion, so i wouldn't exactly call that to fcking up anybody...

if you make a hall of fame page for satoshidice players, i think dooglus deserves a spot.

[SatoshiDICE_PR]

Congratulations to the 2014-11-17 Leader Board Winners:

Geek07357 won 0.2 and Rand09933 won 0.1!

[dooglus]

this is going to end in complete chaos  

I love to see whats coming. Fcking up dooglus is  not a good idea. Come Just-Dice, what do you have?

dooglus won the 1.25 btc leader board reward from the free 0.01 promotion, so i wouldn't exactly call that to fcking up anybody...

if you make a hall of fame page for satoshidice players, i think dooglus deserves a spot.

I don't feel like I was fucked over at all - I just thought the affiliate stuff was wrong. I hadn't realised they had paid, then removed, then re-paid the affiliate earnings. I saw them pay them twice, but didn't notice the un-paying.

As for my satoshidice history, this is my biggest win from them (the yellow highlighted bets were mine):



Mind you, BTC was worth a LOT less back then...

[SatoshiDICE_PR]

I got and withdrew my affiliate money -- thanks! BTW the requirement to deposit dust to be able to withdraw affiliate earnings is a bit pointless.

Yes, basically the system will not allow withdrawals if there's not at least one confirmed deposit. This doesn't affect normal accounts (because they have confirmed deposits) but we will look into correcting this.

While I really like your design, I won't be back unless you you provide a way for someone to audit their own balance by showing a history of deposits (and deposit addresses), withdrawals, giveaways, bets and affiliate earnings.  It's not that I don't trust you, it's just how you arbitrarily modify peoples balances make it feel like a house of cards.

Yes this is a good idea, we will definitely make it possible to view a report of everything that affects the balance.

I know I've seen my account balance adjusted a few times, once I felt was unfair (clawing back 0.01 from an active account) and who knows how much shit I didn't notice?

That account never made any rolls during the giveaway... the 0.01 giveaway bonus in your original account is still counted and added to your balance 

There's also been some strangeness (e.g. balance going down for a withdrawal, then I guess getting canceled and balance going up) which lead me to a lot of confusion about the state of affairs, and as I'm far too lazy to keep my own independent records, so I'd like to be able to skim yours to make sure everything looks sane.

There was in the beginning an erroneous balance reported in the withdraw response. This is probably what you saw before the balance refresh that is made every few seconds. This has since been corrected and it never actually changed any user balances, it was just causing an erroneous balance to display on the page for a few seconds.

[TradersWay.JC]

this is going to end in complete chaos  

I love to see whats coming. Fcking up dooglus is  not a good idea. Come Just-Dice, what do you have?

dooglus won the 1.25 btc leader board reward from the free 0.01 promotion, so i wouldn't exactly call that to fcking up anybody...

if you make a hall of fame page for satoshidice players, i think dooglus deserves a spot.

I don't feel like I was fucked over at all - I just thought the affiliate stuff was wrong. I hadn't realised they had paid, then removed, then re-paid the affiliate earnings. I saw them pay them twice, but didn't notice the un-paying.

As for my satoshidice history, this is my biggest win from them (the yellow highlighted bets were mine):



Mind you, BTC was worth a LOT less back then...

I hadn't checked the dates when I first saw your bets. I was thinking WHATTTT 62 BTC on a single bet!! But then I saw the date

Still, I hope you held onto some of those coins!!

[Farmer17]

this is going to end in complete chaos 

I love to see whats coming. Fcking up dooglus is  not a good idea. Come Just-Dice, what do you have?

dooglus won the 1.25 btc leader board reward from the free 0.01 promotion, so i wouldn't exactly call that to fcking up anybody...

if you make a hall of fame page for satoshidice players, i think dooglus deserves a spot.

I don't feel like I was fucked over at all - I just thought the affiliate stuff was wrong. I hadn't realised they had paid, then removed, then re-paid the affiliate earnings. I saw them pay them twice, but didn't notice the un-paying.

As for my satoshidice history, this is my biggest win from them (the yellow highlighted bets were mine):



Mind you, BTC was worth a LOT less back then...

I hadn't checked the dates when I first saw your bets. I was thinking WHATTTT 62 BTC on a single bet!! But then I saw the date

Still, I hope you held onto some of those coins!!

Check the big win tab and you will see someone betting 0.03 bitcoin on a 0.0015% win chance and receiving 1920 bitcoin. And that bet happened on 2013-03-21 when bitcoin price was somewhere about $70.

Dooglus's "small" bets in 2012 are nothing when compared to that lol.

[avicii123]

I have tested it today, the bug still seems to be working

avicii123, do it. Go grab a few BTC. Then show proof. Explain. Reproduce. Then, return back the BTC you got that you know is not yours. SD should then acknowledge your bug, and they should offer a bounty. But do not hold their BTC hostage, return it in full (except your own deposit of course).

If you can successfully withdraw 10 BTC for example, and return it (or hold it), then I see no reason why SD should not accept 9.9 BTC back. Or whatever bug bounty you guys agree on.

Just my opinion.

Large companies tend not to do any actions until exploits have actually been executed.

This issue has been fixed. Over these last couple of days there's been around a hundred attempts to make parallel withdrawals and they were all executed normally (denying the excess ones if they would have given the account a negative balance).

We can't stop people from trying but the only thing they are likely to accomplish is to lose the 0.0001 transaction fees.

The issue is still not solved... I have tried the exploit today and it still seems to work, so if your interested in fixing it im willing to discuss about it for a good reward.

http://i.gyazo.com/5b271bf35b2da5e99ccc2b5d079d700b.png

[SatoshiDICE_PR]

I have tested it today, the bug still seems to be working

avicii123, do it. Go grab a few BTC. Then show proof. Explain. Reproduce. Then, return back the BTC you got that you know is not yours. SD should then acknowledge your bug, and they should offer a bounty. But do not hold their BTC hostage, return it in full (except your own deposit of course).

If you can successfully withdraw 10 BTC for example, and return it (or hold it), then I see no reason why SD should not accept 9.9 BTC back. Or whatever bug bounty you guys agree on.

Just my opinion.

Large companies tend not to do any actions until exploits have actually been executed.

This issue has been fixed. Over these last couple of days there's been around a hundred attempts to make parallel withdrawals and they were all executed normally (denying the excess ones if they would have given the account a negative balance).

We can't stop people from trying but the only thing they are likely to accomplish is to lose the 0.0001 transaction fees.

The issue is still not solved... I have tried the exploit today and it still seems to work, so if your interested in fixing it im willing to discuss about it for a good reward.

We didn't even make a payout for this amount and you're not giving any other way to identify the payments. If you don't want to show your address in the forum, please PM the transaction id and we'll look it up.