Quote from: ndnh on October 14, 2016, 02:32:26 AM

Quote from: suchmoon on October 14, 2016, 12:05:18 AM

https://bitcointalk.org/index.php?topic=1640756.0

You have to explain in detail how the exploit worked and how you determined which users are involved in it. If I understand it correctly it was an issue with your own site that caused or allowed this to happen so you have to show very clearly that you know what happened, how it happened, how you will deal with the consequences, and how you will prevent this from happening again. Only then I can consider revising my feedback.

The txdice relied purely on transaction hash. Secondstrade was not aware that the transaction id could be known before broadcasting it such that the player can just broadcast the winning ones.
The win rate was very high and made a loss of 9BTC to secondstrade in a very short period. All the others except 3 were refunded. Secondstrade suspected these 3 to be the ones who exploited this vulnerability.

They closed TXdice right after they realized this.

Thanks. It sounds like they don't really have a good way to figure out who cheated. They should at least publish all bets and specify how they decided to pay or not pay the ones they processed manually.

And I still don't see how they could possibly suspect "tautvilis" if his/her last best was a losing one (not sure how to verify that though).