This message was too old and has been purged

[Evil-Knievel]

This message was too old and has been purged

[yakuza699]

invalid TX in between.

What do you mean by invalid transactions? If its non standard it doesn't mean that it's invalid? What kind of transactions their node accepts?

if interested I can replay this attack live with an advanced member here by sending you some amount in BTC to your blockchain.info wallet, and take it back a few hours later.

Does this attack only works against blockchain.info sites I mean the ones that uses it's api? Does that tx appears on other block explorers? If you are serious that it's a real flaw as a lot of the sites uses bblockchain.info api I think even luckyb.it uses it.

[Evil-Knievel]

This message was too old and has been purged

[amaclin]

1. Push flawed TX to blockchain.info
2. It does not get forwarded, but it appears in receipient's wallet.

Only if victim is connected to blockchain.info through the chain of nodes which relay "flawed" transactions

3. See if you win, if so push the TX directly to Eligius-Node (only needed if they take our TX in one of their inputs, if not - even this is not necessary)

Eligius does not accept every valid transaction. It has a check method for malled signatures.

Code:

bool IsCanonicalSignature(const valtype &vchSig, unsigned int flags) {
...
}

[yakuza699]

3. See if you win, if so push the TX directly to Eligius-Node (only needed if they take our TX in one of their inputs, if not - even this is not necessary)

Ahh I see what you did here.So the tx isn't invalid in no way it's just non standard and yes I know that you can push them right here http://eligius.st/~wizkid057/newstats/pushtxn.php.I discovered that flaw like 2 months ago but I didn't knew that blockchain.info accepts non-standard tx's .But did you know that Discus fish also mines non standard transactions and may include your loosing transactions on their block? Did you know that a service or gambling site can include your loosing tx's here https://www.f2pool.com/pushtx?

Also what kind of non-standard transactions you were using?

[Evil-Knievel]

This message was too old and has been purged

[amaclin]

When sending the last output to the victim, it appears as a regular Pay-to-Address transaction with a standard Pay-to-Address input.

The victim will hold this transaction as orphan, because it will not receive previous "flawed" transactions
No service processes orphan transactions.

And yes. Accepting 0-confirmed transactions is known flaw.

[Evil-Knievel]

This message was too old and has been purged

[yakuza699]

When sending the last output to the victim, it appears as a regular Pay-to-Address transaction with a standard Pay-to-Address input.

The victim will hold this transaction as orphan, because it will not receive previous "flawed" transactions
No service processes orphan transactions.

And yes. Accepting 0-confirmed transactions is known flaw.

Actually this will not happen,
as long as they stay within blockchain.info which essentially happens when using the API or a blockchain.info bitcoin node (and this is the flaw that I am describing) it will look like a regular transaction,
no orphan, no Nonstandard, nothing. Perfectly valid, canonical signature, canonical pubkey.

Please setup a blockchain.info wallet and you will see what I mean. I will send you some "coins".

Ok lets see how it goes send me some "coins" to this address 1FnHPWNjXbaS8k7jxkHBJbzBNPc6ymKnwA

[Evil-Knievel]

This message was too old and has been purged

[volumekeyman]

I am not sure if this is the correct topic and the discussion is about the thing that happened to me earlier. But this is my experience. I gambled on lucky bit. I sent 0.25 x2 bets on green, both of them hit x0.4 and in return I got 0.2 HTC.  I got disappointed because I lost a big amount on it. All the transactions even confirmed. After losing the money, I roughly had 1.02,earlier it was 1.32. But two days later when I saw my balance  it was back to 1.32 btc. I was astonished. I even went through the transactions of the address from which I gambled. Only 3 transactions showed up which were not from the gambling day. I even went through the bet browser of lucky bit. When I clicked on the transaction link, bc used to show that transaction was not found.

I am still unsure how this happened even after the transactions gained good number of confirmations.

[yakuza699]

I am not sure if this is the correct topic and the discussion is about the thing that happened to me earlier. But this is my experience. I gambled on lucky bit. I sent 0.25 x2 bets on green, both of them hit x0.4 and in return I got 0.2 HTC.  I got disappointed because I lost a big amount on it. All the transactions even confirmed. After losing the money, I roughly had 1.02,earlier it was 1.32. But two days later when I saw my balance  it was back to 1.32 btc. I was astonished. I even went through the transactions of the address from which I gambled. Only 3 transactions showed up which were not from the gambling day. I even went through the bet browser of lucky bit. When I clicked on the transaction link, bc used to show that transaction was not found.

I am still unsure how this happened even after the transactions gained good number of confirmations.

If you would read the posts above you would see that blockchain.info isn't good at it's job and is sometimes showing bad information.

[amaclin]

The stuck tx is https://blockchain.info/tx/4f83091073fff087cbe65d2017ab2f2e926602e7d0cc0bf11c55192d9bc72e25

It is valid, but no nodes accept it.
Every transaction which spends outputs from it will be orphan
So, LuckyBit will not receive your deposit. You can not gamble with this "flaw" - there is no bet from the casino side from you.

Of course, this transaction can be included to a block.
I do not see new flaws here.
No one should accept and redeem 0-confirmed transactions, especially if they have non-standard parents

[Evil-Knievel]

This message was too old and has been purged

[amaclin]

If, and I say it again --- IF --- a site uses the Blockchain.info API to check for payments,

The most stupid thing I have ever heard - is to rely on untrusted third-party in decentralized network, which was created to eliminate trusted third-parties

If luckyb.it uses the Blockchain.info API...

Definitely not.

[Emily008]

Thanks. I was planning to use Blockchain.info API.

[Evil-Knievel]

This message was too old and has been purged

[cloverme]

Thanks for the info, it seems there are a lot of issues in using them. I'm surprised though it took this long for it to turn up, maybe it's a recent flaw with an update to the API? Maybe they'll give you a reward for finding it.

[Evil-Knievel]

This message was too old and has been purged

[amaclin]

Huge problem for 0-confirmation services.

I repeat: this is only a problem for those who rely on the information from blockchain.info API