Quote from: JackpotRacer on March 21, 2019, 03:01:56 PM

Quote from: StackGambler on March 21, 2019, 03:00:32 PM

Quote from: JackpotRacer on March 21, 2019, 01:36:27 PM

Quote from: devans on March 21, 2019, 12:48:58 PM

Earlier today, an attacker exploited a previously unknown vulnerability in one of bustabit's API methods which allowed him to find out the current game's outcome before its end. By exploiting this bug the attacker managed to win a total of 122.5686 BTC and empty the hot wallet.

I have confirmed the existence of this vulnerability and deployed a fix for it. In a few minutes, the game will resume and the hot wallet refilled.

bustabit will reimburse all affected bankroll investors out of pocket. Each investor's account will be credited with the full amount of bits lost to the attacker and an equal amount of dilution fee credits. Because I want to ensure that all affected investors are made whole (vs just adding 122.5686 BTC to the bankroll again), this will take 1-2 days while I calculate how much each investors is owed.

There is no indication that this vulnerability was exploited before today. Player funds were not at risk at any point in time. The problem was specific to bustabit and bustadice was not affected in any way.

Chapeau! for the way you handle it

as I thought about licensing a bustabit version, how would it be handled if I got hacked with this kind of hack? who would pay for the damage?

bustabit v2 code is not available for licensing. v1 code is available, but it is not subject to the same vulnerability, which involves the betID parameter.

thx but that does not answer my question

Only Daniel is qualified to answer this, but here's what I think he'd say. The main product you purchase is the license, which is your name on the license.txt file. You also get the code along with this, or you can use the public code which is posted on Github. Now, it's your site's responsbility to make sure the code doesn't have bugs. If, for some reason, the code causes your v1 clone to use money, I think Daniel would not reimburse you, because it's your responsibility to have thoroughly audited the code before implementation.

Also, keep in mind that there are 20-30 sites that are running on v1 code, and there have been no serious exploits or bugs thus far, so it's unlikely that one will crop up any time soon, unless people make heavy edits to the code before deployment.