Post
Topic
Board Service Announcements
Re: [Payout Updates] Bitcoinica site is taken offline for security investigation
by
coinft
on 16/06/2012, 14:38:20 UTC
I was just looking at a piece of code for hedging and saw 3 bugs and numerous hacks to work around flaws. It doesn't surprise me that third time lucky it blows up.

Care to point out the 3 bugs and various hacks?

I know it's not world-class code, but isn't it just business logic and nothing else?

Quote
class HedgingJob
  
  @queue = :normal
  
  def self.perform
    
    confidence_level = Setting.where(:key => "confidence_level").first.value.to_f
    surplus = Setting.where(:key => "surplus").first.value.to_f
    if Setting.where(:key => "buy_factor").first
      buy_factor = Setting.where(:key => "buy_factor").first.value.to_f
      sell_factor = Setting.where(:key => "sell_factor").first.value.to_f
    else
      buy_factor = 1
      sell_factor = 1
    end
    
    if surplus.abs > confidence_level
      amount = surplus.abs - confidence_level
      if surplus > 0
        amount *= buy_factor
        price = Ticker.last_tick("BTCUSD").selling * 1.02
        response = MtGox.buy!(amount, price)
        Setting.change_surplus(0-amount/buy_factor)
      else
        amount *= sell_factor
        price = Ticker.last_tick("BTCUSD").buying / 1.02
        response = MtGox.sell!(amount, price)
        amount = 0 - amount
        Setting.change_surplus(0-amount/sell_factor)
      end
      
      Trade.create(:amount => amount, :price => price, :response => response.to_s[0..253])
    
    end
    
    
    
  end
  
end

There's no excuse to write methods longer than 3-5 lines in ruby, and a functional style would help to understand, verify and test this much better. You should really separate the code which accesses the DB, calculates the amount to buy or sell, and executes the hedging trade with the result for better testability.

Also, unless you still own the code, posting and discussing this openly may get you into hot waters with whoever salvages the remaining pieces of bitcoinica.

-coinft.