Quote from: RHavar on October 19, 2016, 02:22:15 AM

Quote from: ndnh on October 19, 2016, 02:19:29 AM

I think probably it is added back to the investors at the time of adding back. So if someone divested, he won't get anything, but if someone invested, he would get a share of the added back amount Huh

Yeah, that's how it sounds like. Actually when I designed the moneypot investment system, what I did was create a repayable log of all the investment/divestment/bet events for in a nightmare situation like this (or software bug) it could be replayed so investors wouldn't have made/lost money from the changes in the bankroll when a fake better (or software bug) was playing.

The situation is probably a big mess now, as some investors have lost more than they should've and others made more than they should've. And it's probably pretty likely the ones who unfairly made money have already withdrawn (?) or at the very least, will be unhappy if their balance gets put to the correct amount

The log is a pretty good idea. I don't think there are many casinos here that have such a mechanism, probably just Moneypot. Cheesy

https://bitcointalk.org/index.php?topic=1366689.msg13969066#msg13969066 did they use the log when they removed the duplicate bets, or did they just add or subtract it back to the latest balance pro rata? I assume the latter because it is much easier?

Quote from: fluffypony on October 19, 2016, 07:52:39 AM

So then you cut your losses and you get out, the end. There is no coming back later on to try reclaim imagined profit.

Perhaps a comparison will help: let's say that you have 10 BTC in Poloniex. You hear that Poloniex isn't processing BTC withdrawals, along with panic that they're hacked, and use your BTC to buy a bunch of WaffleCoin and withdraw it. You sell your WaffleCoin on ShapeShift, but now the market's tanked and you end up with 9 BTC. Later that day Poloniex put out a statement apologising for the issues and stating that they're now fixed. Would you insist that they roll the trades back? What about the shorters that took profit from you?

Or what if you invested in a startup, and then when it looked like things were going south you sold your investment at a loss. Two years later the startup is a huge, successful company. Do you insist on taking profit from the growth because you *used to be* an investor?
-snip-
We thought about this, but we decided that it would be too dangerous for us to spend days and weeks trying to build a magical "undo" script, completely wrecking any auditability, and potentially ending up with a screwed up data set at the end.
-snip-
With all respect to the affected investor, he took his $100 loss and walked away. He didn't contact us, he didn't ask for input on how we were going to handle things. He just assumed that it was the end, and he would have been the *only* investor to get out with his money had we not had safeguards and had the attacker been able to actually drain the wallet. What would have happened then?

I disagree with almost all of the examples. You cannot consider all your investors as a single entity.

Well, if you can set the investor's balance as would have if this guy didn't make the bets, it will be the best thing to do, especially if the amount added back is of a significant amount to the bankroll.

If you cannot, however, well...

Anyway, did you make certain you could not add it back in a fairer way?

To be honest, I considered investing once I read Grin

Quote from: fluffypony on October 18, 2016, 09:11:47 AM

Looks like they managed to grab the server seed through a leak in the API - we're busy patching it, and will rollback the naughty bets. Thankfully we process every single withdrawal manually, and most of the funds are all locked up in a cold wallet, so no money was lost. It's precisely because of the very high risk of an exploit that we don't let withdrawals process automatically!

(I didn't though) so I can't say the adding back was very fair. Anyone paying attention could guess well in advance what was gonna happen and make a profit.

Quote

Nevertheless, I've already offered to send $100 to the affected investor, so I'm not sure what more you expect?

That is nice