search

RoboSats / robosats

A simple and private bitcoin exchange
https://learn.robosats.com
GNU Affero General Public License v3.0
736 stars 144 forks source link

Potential issue of a bad actor hiding the order book #1439

Open tmwclaxton opened 2 months ago

tmwclaxton commented 2 months ago

Describe the bug An offer can be hidden from the order book by accepting it, but not paying the bond for a few minutes at a time. You could in theory then automate creating robots and accepting offers repeatedly so that only your orders get picked.

To Reproduce Steps to reproduce the behavior:

  1. Create robots
  2. Accept offer - don't pay bond
  3. Log out - create new robot - observe offer is now gone

Expected behavior Offers shouldn't disappear until their taker bond is paid; bonds should be refunded to people who weren't able to pay in time.

iucrypto commented 2 months ago

I sent funds, then the order was cancelled. I only received my bond back. I wasn't refunded my fiat, and didn't receive my lightning. Any advice on what to do? I still have the token.

KoalaSat commented 2 months ago

I sent funds, then the order was cancelled. I only received my bond back. I wasn't refunded my fiat, and didn't receive my lightning. Any advice on what to do? I still have the token.

So you had an on going trade where you already sent fiat and the order was cancelled? How is that? Do you have screenshot or more details?

g0lden3agle commented 2 weeks ago

Won’t this introduce new complexities in if multiple robots are attempting to pay the bond simultaneously? Maybe a new “pending” state on the order book so only one user can still be paying the invoice but everyone can see that may become available again?

femelo commented 1 week ago

Won’t this introduce new complexities in if multiple robots are attempting to pay the bond simultaneously? Maybe a new “pending” state on the order book so only one user can still be paying the invoice but everyone can see that may become available again?

A solution would be to keep the order visible in the book but disable it to clicks with a visual feedback to indicate there is currently someone in process of locking the bond. That way, if other robot is interested in the order, it can watch the order state up until it becomes available again, which will probably elicit a watch list for users as a complementary feature.