Quote from: Stammer on February 27, 2014, 06:14:45 AM

I would like to read more about this. AFAIU transaction malleability is still an open wound in the Bitcoin protocol. Understanding its implications is important.

I found this thread , Maged's post about the Mt.Gox mess in particular, quite instructive.

By the way, Maged writes:

Quote from: Maged on February 18, 2014, 12:19:47 AM

...

Quote from: pythonscript on February 17, 2014, 09:55:25 PM

This means that it's not possible for both transactions to be in the blockchain, so people/organizations affected by this won't have to go through the blockchain to find people who double-withdrew, right?

Yes. Only one can ultimately exist in the blockchain.

He mentions that SR2 was a scam using this as cover. It is quite possible that gox is the same.

This is my understanding, the best that I've been able to put together.

Gox's custom software doesn't always strip leading zero bytes from signature values. Sipa estimated (on IRC) that only ~1% of gox transactions had excessive padding.

A while back, this was no big deal because the network would happily relay both forms, so any attempt at changing the transaction would result in a race. Later, the default node behavior changed to not relay the padded version. Once this changed, the original would pretty much always lose the race, if there was one.

Next, someone made a bot to "fix" transactions on the fly. Quite possibly this person was sick of waiting for their money and/or was just being helpful.

So, we have 3 eras.

First, all transactions confirm normally.
Second, 1% of transactions never confirm.
Third, 1% of transactions confirm in modified form.

Only the third era is vulnerable, but it is a relatively short era. I don't think anyone knows exactly how long it has been going on, but it can't have been years because the second era isn't that old either.

Now, to exploit this, you'd need to get lucky, or you'd need to keep up a massive circular flow out of and then back into gox. Remember that each transaction has about a 1% chance. So, 99% of the time that you withdraw your balance, it works fine. And you have to wait 6 or 7 confirmations (minimum) before you can try again. You'd get about 85 chances per year, so if we assume the third era was about a year long, figure the average attacker could have doubled their money about once in that time.

It just doesn't add up. Someone is lying, or there are very important things that we don't know yet.