Quote from: FloridaBill on September 21, 2017, 10:53:57 AM

****IT APPEARS THERE IS A WAY TO HACK THOSE BOGUS TOKENS CRYPTONEX SPAMMED US WITH*********

I was, and still am, pissed that CNX would SPAM the wallets of who knows how many people (there were 20,800 addresses in my drop, and an unknown number of drops) with what they knew would be taken as an air-drop with real value. I was one of who knows how many people that spent ETH trying to send this SPAM to an exchange, and then wasted an hour trying to figure out why it kept being rejected. This SPAM masquerading as a token has the exact contract address as the "authentic" CNX tokens. And it's the same contract EtherDelta has posted as belonging to the token they are facilitating a market in.

I would advise extreme caution in dealing with any company that so blatantly has such little regard for the time of their potential investor/partners. By doing this type of deception while attempting to acquire investors, consider yourself forewarned on what they consider to be acceptable behavior and ethics.

It is for that reason that I do not feel bad for Cryptonex if we are able to turn this SPAM into real CNX; I consider it due payment for wasting my time.

THE HACK

First I needed to see if any of the CNX listed on EtherDelta began life as SPAM, so I took a look at EDs wallet to verify their CNX had the same contract number as my SPAM, and it did. Next, I used ethplorer.io to locate the TXs numbers of the CNX being moved into EDs wallet, and from that list I picked one at random. Again using ethplorer.io I used the incoming TX number to identify the sending wallet address, and then I looked at the sending wallet to see if by chance the CNX they sent to ED had arrived into their wallet as the same type of SPAM we all received, and sure enough it did! Here is the TX showing the CNX being moved to the ED contract: https://ethplorer.io/tx/0x6bfdf8ece98c5434f08e3a798f474fc44af4d4822994a666546d620750a5d838. Here is the wallet that TX identified as sending it: https://ethplorer.io/address/0xbc1845a864aa2a7ba7513bc6837ff7d66ec191c4. And here is the TX of that wallet receiving the SPAM in one of the drops: https://ethplorer.io/tx/0xce14f05d62ca21166d4cb91c6d33eb7aadf9abc141cc9f6de2d3284113bfb49c.

Don't you just love an open, distributed, immutable blockchain! So, why was his/her transfer to ED accepted and mine wasn't? Well, it turns out that when we received the SPAM it had additional information in the data field, and when this person sent his SPAM to ED he included data (not the same date that was on his receiving TX) and that little bit of extra data turned the SPAM into real CNX tokens! Unfortunately I don't know how to read that data, but without doubt someone reading this will...if that is you you, please post back what the date needs to be relative to the SPAM received for each of us. For reference, here is the magic snippet included in the data field:

338B5DEA00000000000000000000000094D6B4FB35FB08CB34AA716AB40049EC880020790000000 000000000000000000000000000000000000000000000001742810700.

For those with the knowledge in this field, I went one step further; I called up my failed TX to ED in etherscan.io and, under Tools & Utilities ran a Parity Trace, receiving this (I replaced my address & TX number with ****):

  {
   "action": {
   "callType": "call",
   "from": "*********************************",
   "gas": "0x4bb8",
   "input": "0x0a19b14a000000000000000000000000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000c7d713b49da000000000000000000000000 000094d6b4fb35fb08cb34aa716ab40049ec8800207900000000000000000000000000000000000 000000000000000000014f46b040000000000000000000000000000000000000000000000000000 0000000041bae500000000000000000000000000000000000000000000000000000000bf6318660 0000000000000000000000059f9d4c004ab4f13d74940ffc1edca08b76915cd0000000000000000 00000000000000000000000000000000000000000000001ce4ab3dbdc20c9c17d5ef7b61e5069c9 873648bdbf8fca1d816c446b0f14ed8920b154098139e060625c34e0e10040a90c164210f1f1189 7a245fe7f72aaa4a1b000000000000000000000000000000000000000000000000000000e8d4a51 000",
   "to": "0x8d12a197cb00d4747a1fe03395095ce2a5cc6819",
   "value": "0x0"
   },
   "blockHash": "0x31a1623597629e2ffd6a929a83858d77bad489ee095b285d4320cd4c43e14c72",
   "blockNumber": 4297740,
   "error": "Out of gas",
   "subtraces": 0,
   "traceAddress": [],
   "transactionHash": "0x8*******************************************************bf92d2f1",
   "transactionPosition": 18,
   "type": "call"
  }
]

I know my TX shows an out of gas error, but the deviation from the successful TX was before the out of gas. Here's the Parity Scan for the TX that successfully converted the SPAM into real CNX (I am leaving all data underacted, since we don't have any way to tie this to a specific person):

{
   "action": {
   "callType": "call",
   "from": "0xbc1845a864aa2a7ba7513bc6837ff7d66ec191c4",
   "gas": "0x376f8",
   "input": "0x338b5dea00000000000000000000000094d6b4fb35fb08cb34aa716ab40049ec8800207900000 00000000000000000000000000000000000000000000000001742810700",
   "to": "0x8d12a197cb00d4747a1fe03395095ce2a5cc6819",
   "value": "0x0"
   },
   "blockHash": "0x76e8a2457fbbe8ae46411ca8045685c7be4ac4170d20f01434547f3e2248267d",
   "blockNumber": 4290402,
   "result": {
   "gasUsed": "0xb0e6",
   "output": "0x"
   },
   "subtraces": 1,
   "traceAddress": [],
   "transactionHash": "0x6bfdf8ece98c5434f08e3a798f474fc44af4d4822994a666546d620750a5d838",
   "transactionPosition": 48,
   "type": "call"
  },
  {
   "action": {
   "callType": "call",
   "from": "0x8d12a197cb00d4747a1fe03395095ce2a5cc6819",
   "gas": "0x360cd",
   "input": "0x23b872dd000000000000000000000000bc1845a864aa2a7ba7513bc6837ff7d66ec191c400000 00000000000000000008d12a197cb00d4747a1fe03395095ce2a5cc681900000000000000000000 00000000000000000000000000000000001742810700",
   "to": "0x94d6b4fb35fb08cb34aa716ab40049ec88002079",
   "value": "0x0"
   },
   "blockHash": "0x76e8a2457fbbe8ae46411ca8045685c7be4ac4170d20f01434547f3e2248267d",
   "blockNumber": 4290402,
   "result": {
   "gasUsed": "0x4f7e",
   "output": "0x0000000000000000000000000000000000000000000000000000000000000001"
   },
   "subtraces": 0,
   "traceAddress": [
   0
   ],
   "transactionHash": "0x6bfdf8ece98c5434f08e3a798f474fc44af4d4822994a666546d620750a5d838",
   "transactionPosition": 48,
   "type": "call"
  }

So, whoever you are reading this that knows what data needs to go in the data field for us to be able to do the same thing (which I assume will vary based upon the address the SPAM was set to, and maybe the data attached to the original SPAM), please take a minute to post a reply letting us know. In addition to rightly deserving compensation for the intrusion into our wallets, for the wasted ETH trying to send what they KNEW would be taken as an air drop, and for our wasted time in doing this....with a piece of SPAM!...we need to set a deterrence against such unethical practices by others in the future. Otherwise it's just a matter of time before our wallets become as filled with SPAM as our email.

Best regards,

Bill

Thanks for sharing your point of view with us.
CNX has its own blockchain. It's not a spam, but the bonus tokens which can be used as a 20% bonus on subsequent CNX purchases. After the ICO is over they will not be useless. In October we will officially announce it.