Feedback-ID: i525146e8:Fastmail
Date: Sat, 3 Dec 2022 07:12:02 -0500
From: Peter Todd <pete@petertodd.org>
To: Daniel Lipshitz <daniel@gap600.com>
Message-ID: <Y4s9EqMfk+yXCzIO@petertodd.org>
References: <CACkWPs8-rZpGSJSEyLsg9gVAuPpHztXWSZvfGscGJCn05th0DQ@mail.gmail.com>
 <Y4l/ZHl9EvhaCpix@petertodd.org>
 <CACkWPs_v=MYFrn=LzPSK4+=Enw2R5+REap+MFLRhwtxcwGvEHA@mail.gmail.com>
 <Y4sNxWkBp7+ogcJb@petertodd.org>
 <CACkWPs9p0K-1RbVMipiAwjhexaNgmMgjENYvd9S1DpA+JVcE=w@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="VL0KHd0h3JlJne/c"
Content-Disposition: inline
In-Reply-To: <CACkWPs9p0K-1RbVMipiAwjhexaNgmMgjENYvd9S1DpA+JVcE=w@mail.gmail.com>
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] [Opt-in full-RBF] Zero-conf apps in immediate
 danger
Precedence: list


--VL0KHd0h3JlJne/c
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sat, Dec 03, 2022 at 01:01:16PM +0200, Daniel Lipshitz wrote:
> Shapeshift used to be clients in fact one of our first when we started in
> 2016.
>=20
> They no longer use our service but from time to time use us for fee
> recommendations. So we actually should remove their logo as a current
> client.

Yes you should. When did ShapeShift stop using your service? Did they expla=
in
why?

> If you wish to test it out try find a merchant using Coinpayments or
> Coinspaid.
>=20
> Also some of our non custodial liquidity providers offer service no
> custodial wallets. I am not sure which.

I see that you also advertise that Gap600 is "Trusted by" Coindirect and
Coinify, both AML/KYC crypto exchanges. Obviously, with full AML/KYC
double-spends are not much of a concern. And it's not even clear that
either accepts zeroconf anyway, as I'll explain later.

On this list you claimed that:

>  1. As of end of Nov 2022 - GAP600 has processed i.e responded to circa
>  15M transactions
>  2. These transactions have a cumulative value of 2.3B USD value.
>  3. We currently are seeing circa 1.5M transactions queired per month.

What's the value and number of transactions that *actually* rely on your
unconfirmed transaction tools? The only category that would apply for is go=
ods
provided immediately and irrovocably, without AML/KYC. Because it sounds li=
ke
these figures may be significantly overstated.


Re: CoinsPaid, what you say here makes it also sound like it relies on AML/=
KYC:

> CoinsPaid applies a special software tool across its solutions to conduct
> stringent KYC procedures and a risk-based approach to CDD that verify user
> identities to mitigate fraud, money laundering and other activities linke=
d to
> criminality and terrorism.
https://www.gap600.com/uncategorized/coinspaid/

Re: Coindirect, the documentation I can find appears to say that confirmati=
ons
are required before you can use coins deposited into Coindirect:

> Digital currency transactions must be confirmed on the relevant network b=
lock
> before they are considered valid. Only once confirmed, will you be able to
> use the coins deposited in your Coindirect wallet.
https://help.coindirect.com/hc/en-us/articles/115002441974-How-quickly-can-=
I-use-coins-deposited-into-my-Coindirect-wallet-

This is repeated here as well: https://help.coindirect.com/hc/en-us/article=
s/4409120006546--Deposits-

Re: Coinify, the API docs don't give any indication of risk scoring or any
other Gap600 integration:

https://merchant.coinify.com/docs/api/#payment-object

--=20
https://petertodd.org 'peter'[:-1]@petertodd.org

--VL0KHd0h3JlJne/c
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE0RcYcKRzsEwFZ3N5Lly11TVRLzcFAmOLPQsACgkQLly11TVR
LzcPThAAsS6iPOvSQTizMCduMdB/+/mkhlveHI4Uds/ricBc1TVbRo9Fec1QkMfP
LUzff9tOS8NDM2iwjgtNbdgJqvVB6APSLHPhOzRw0ifeMCV86KLBmOlJU3j4o9+p
c+7tic9YThKx146ibrGYmvFFys5DPg2fre2p8s97vJFw4wNvAyEg4Km+f/BN4MPq
ZIJbEnic014+5kDUBEqW79OkZK5tvbM47ei80uncy5Bndsoaij0sqNFnZIB3gUWN
8LN7atCKtm6PK5ZiOIMFKAdzyUbZNtGPU7HpS60L1pcQxzS/PUCUzsxnmDLgMzot
ZdCrfEL3J5CG6cq0d9WBkzxYWIrlYJ6xjRIzJmCmCD1cPZth7M/+JV7xaOTL834Q
g29zMAcz9udy+Xntzip1j1iMv6j1oMMsHUAmMfRp0qUoP13L4npc2Q0dIKQiLepf
g/JcRvUQzEQ+/Oj8tfmayvFix8eW9QWQ62qzU8JT0pEyylAfFw+cSGLvq4lPWqpq
pUgry15j9pLq3K4Sh08ifIxEjrZwx7s0k8hmhKaYhMgAAsT3ZHZxFffjIazQjrl/
I3ilf4HKEY+oQT4wrsuU+rcICZ4dr41KWLrjvH6rtjR/fx2UPEWdcqq7sjIu1wJp
BfCqMbGB6aDyJ/UjFgO60ipRIbHRv1r/hOl3p/wRAnE4tgtkb5s=
=wKho
-----END PGP SIGNATURE-----

--VL0KHd0h3JlJne/c--