MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8;
 format=flowed
Content-Transfer-Encoding: 7bit
Date: Wed, 15 Jul 2015 03:29:25 +0000
From: simongreen@airmail.cc
To: bitcoin-dev@lists.linuxfoundation.org
Message-ID: <24662b038abc45da7f3990e12a649b8a@airmail.cc>
User-Agent: Roundcube Webmail/0.9.5
Subject: [bitcoin-dev] Significant losses by double-spending unconfirmed
	transactions
Precedence: list

With my black hat on I recently performed numerous profitable 
double-spend attacks against zeroconf accepting fools. With my white hat 
on, I'm warning everyone. The strategy is simple:

tx1: To merchant, but dust/low-fee/reused-address/large-size/etc. 
anything that miners don't always accept.

tx2: After merchant gives up valuable thing in return, normal tx without 
triggering spam protections. (loltasticly a Mike Hearn Bitcoin XT node 
was used to relay the double-spends)

Example success story: tx1 paying Shapeshift.io with 6uBTC output is not 
dust under post-Hearn-relay-drop rules, but is dust under 
pre-Hearn-relay-drop rules, followed by tx2 w/o the output and not 
paying Shapeshift.io. F2Pool/Eligius/BTCChina/AntPool etc. are all 
miners who have reverted Hearn's 10x relay fee drop as recommended by 
v0.11.0 release notes and accept these double-spends. Shapeshift.io lost 
~3 BTC this week in multiple txs. (they're no longer accepting zeroconf)

Example success story #2: tx1 with post-Hearn-relay drop fee, followed 
by tx2 with higher fee. Such stupidly low fee txs just don't get mined, 
so wait for a miner to mine tx2. Bought a silly amount of reddit gold 
off Coinbase this way among other things. I'm surprised that reddit 
didn't cancel the "fools-gold" after tx reversal. (did Coinbase 
guarantee those txs?) Also found multiple Bitcoin ATMs vulnerable to 
this attack. (but simulated attack with tx2s still paying ATM because 
didn't want to go to trouble of good phys opsec)

Shoutouts to BitPay who did things right and notified merchant properly 
when tx was reversed.

In summary, every target depending on zeroconf vulnerable and lost 
significant sums of money to totally trivial attacks with high 
probability. No need for RBF to do this, just normal variations in miner 
policy. Shapeshift claims to use Super Sophisticated Network Sybil 
Attacking Monitoring from Blockcypher, but relay nodes != miner policy.

Consider yourself warned! My hat is whiter than most, and my skills not 
particularly good.

What to do? Users: Listen to the experts and stop relying on zeroconf. 
Black hats: Profit!