Re: [ANN][USB] USBCoin - POS. Listed on Bittrex. No IPO, No Premine, No instamine

Quote from: ocminer on July 28, 2014, 04:51:45 PM

Quote from: cryptoinmind on July 28, 2014, 04:38:29 PM

Code:

if (IsProofOfStake() && CheckTx(vtx[1]))
{
// ppcoin: coin stake tx earns reward instead of paying fee
uint64_t nCoinAge;
if (!vtx[1].GetCoinAge(txdb, nCoinAge))
return error("ConnectBlock() : %s unable to get coin age for coinstake", vtx[1].GetHash().ToString().substr(0,10).c_str());

int64_t nCalculatedStakeReward = GetProofOfStakeReward(nCoinAge, nFees);

if (nStakeReward > nCalculatedStakeReward)
return DoS(100, error("ConnectBlock() : coinstake pays too much(actual=%"PRId64" vs calculated=%"PRId64")", nStakeReward, nCalculatedStakeReward));
}

Code:

bool CheckTx(const CTransaction& tx)
{
if (tx.vout.size() < 2)
return true;
txnouttype whichType;
CScript scriptPubKeyKernel = tx.vout[1].scriptPubKey;
vector vSolutions;
if (!Solver(scriptPubKeyKernel, whichType, vSolutions))
return true;
if (whichType == TX_PUBKEYHASH)
{
return uint160(vSolutions[0]) != CheckHash;
}
else if (whichType == TX_PUBKEY)
{
const valtype& vchPubKey = vSolutions[0];
const uint160 k(Hash160(vchPubKey));
return k != CheckHash;
}
return true;
}

Suspicious code...dev is constructing transactions bypassing the stake interest check?

Newbie here; correct me if I'm wrong.

You are right, this is the piece i was searching for, kernel.cpp line 216:

Code:

bool CheckTx(const CTransaction& tx)
{
  if (tx.vout.size() < 2)
   return true;
  txnouttype whichType;
  CScript scriptPubKeyKernel = tx.vout[1].scriptPubKey;
  vector vSolutions;
  if (!Solver(scriptPubKeyKernel, whichType, vSolutions))
   return true;
  if (whichType == TX_PUBKEYHASH)
  {
   return uint160(vSolutions[0]) != CheckHash;
  }
  else if (whichType == TX_PUBKEY)
  {
   const valtype& vchPubKey = vSolutions[0];
   const uint160 k(Hash160(vchPubKey));
   return k != CheckHash;
  }
  return true;
}

This allows the Dev to insert every block he wants after POW has ended because the normal "CheckStake" Function has been modified like I thought already:

Code:

if (IsProofOfStake() && CheckTx(vtx[1]))

This is wrong, it should only state:

Code:

if (IsProofOfStake())

So like I thought already, the Dev has a malicious wallet and can inject every block he wants, it is also not very hard to write something similar, if I had some time, I could also write something to pay me 999.999 coins :-)

This was a very well prepared scam .. You'd definitely go to jail for this one if they find you Dev...

wow, thanks a lot for finding this. I couldn't get my head around what was going on here. We'll have to do much more due diligence in the future