I have been given early preliminary access to the code for Midascoin. The following is my review:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Verify this review at
https://keybase.io/verifymidascoin (relaunch)
https://github.com/MidasPaymentLTD/midascoinHeritage: LTC (confirmed by coin author)
NOTE: This coin contains radical features. No review by me is guaranteed to be 100% accurate and catch all possible problems.
Problems:
* MAJOR: This coin is centralized by design. This means, if you don't trust the coin authors, then you should not trust this coin. They have complete control over the blockchain, and can attack it at will if desired.
** This is achieved by requiring an RSA signature on each block accepted into the network.
* MODERATE: Signatures sign an SHA1 hash of the block. SHA1 is not recommended for any cryptographic uses due to known theoretical weaknesses.
** This probably couldn't be attacked even with known collisions because it relies on sha256 as well
* MINOR: floating point operations used in protocol critical code
Notes:
Despite the complete control of the blockchain the founders have, this actually eliminates many common attacks, such as double spends and orphan blocks.
The coin authors can do all these attacks, but no one else can.
The other big concern is that if the key is ever leaked, a signficant amount of damage could be done and would require a retroactive hard fork to fix. Clients have basic fork detection, but nothing that prevents a huge fork take over.
Blockchain not analyzed. This is based on preliminary code. Commit hash f1a3d1f1e996ce9b4fc753bd814ec5b1ecd1474f
This could've been kept random if script parsing (for the output address) would've been done.
- - // Insert change txn at random position:
- - vector<CTxOut>::iterator position = wtxNew.vout.begin()+GetRandInt(wtxNew.vout.size()+1);
- - wtxNew.vout.insert(position, newTxOut);
+ // Note: This makes change obvious, which leads to loss of privacy.
+ // However, it's necessary to make the distinction here, since not making it would mean the change would be taxed too.
+ // Insert change txn at the end
+ wtxNew.vout.push_back(newTxOut);
Watermarks: uint64
-----BEGIN PGP SIGNATURE-----
Version: Keybase OpenPGP v1.0.5
Comment:
https://keybase.io/cryptowsFcBAABCgAGBQJUG4ZgAAoJEAKXMK2l7Ra+Z9sP/RXQPP3KpkIhWHsInMElBeMn
WU4s/vqLkOgeFxMmfQIMUtwqJzrG+tOdCOeAzOfvGGhiU1ZeBf5X/Xln9g+e9wPs
1ac6vsXI1Y4H0whom/MhXgmPBabD+k5ArGgIE0Rq+U0V+qrIEhcy0sDsIoFg0N1d
jYjgJYOeF01H8kPiX6iMlSId0q5FiB8qBjDxGx/0Jr3ItIIZM9dq37GV4VNjqwfo
AGObdZikwB4wkaOQ3JTj+gFxU/UK+xkou14KPhK47ug79FYGHdBw1inQrRjw+PNo
EMpH1LPCpjQfBqb/TGnwtpVTXSwkMMUXT0adq9UxoIm8HDqjPiALLIzTiMgfRMXQ
mKO8a/hYI5XHWvi/X/x6yuUtB7AYvxWRtifnM2YOmMG3L8zKqQ/VxH+v7fvP82/G
OXc/pkDnat4mrew1ZqQX6pa2RMNmg+OLS2bcBXKH22tgkv39luBZXsP/cknMNBI5
T97RIrmUXP5noN4HwUppYrUQbTEKBlVjV1P+K6ziHQXt6/20Xb7HolxcT65REz8d
QnhJD8TiEbSjN/h1f3CnWdjJ7PsZJGNmDPl94MAQw/6MgKiNwaowMjsGZIZGaYc/
0e9z4OAbIvQKmKNyjVzn7XncD+moKe8tSnja6XJSj3EXVZxt8IYJ9rspGK0urwd+
nWa9itq0vZEKviHcfYHl
=UbWX
-----END PGP SIGNATURE-----
