Buying from yourself doesn't deduct buy currency, but does add it, allowing user to print infinite currency

The-GNTL-Project / Exchange

https://exchange.gntl.co.uk

3 stars 0 forks source link

Buying from yourself doesn't deduct buy currency, but does add it, allowing user to print infinite currency #77

Closed ElectricDosh closed 3 years ago

ElectricDosh commented 3 years ago

I just made 66 billion GNTL in a couple of minutes, trying to push it over 100 billion leads to a white label error page.

Steps to reproduce: List a sell order and buy the order from yourself, you can double your holdings in the base currency every time. Tested on both XMR and ARG pairs and happens on both. Doing the reverse (listing a buy order and selling to yourself) seems to work as expected, you end up with the same amount of the base currency and ~0.2% less of the other.

tylerjohneddy commented 3 years ago

Thought I had sorted this ... Right I'll look in to it again

tylerjohneddy commented 3 years ago

this should be fixed, please check

sudoebm commented 3 years ago

It doesn't print currency anymore, but it does still charge a fee.

tylerjohneddy commented 3 years ago

i would say that is correct, a trade has been completed. @sudoebm do you disagree?

sudoebm commented 3 years ago

i would say that is correct, a trade has been completed. @sudoebm do you disagree?

I agree that the logic behind the function is correct, but I was working on the assumption that there is no practical reason to create a sale order then buy your own order. In my opinion users shouldn't have the ability to buy their own orders.

bennytehcat commented 3 years ago

AFAIK, there is nothing in the trade logic that says you can't buy/sell to yourself. Accordingly you should be charged a fee even though nothing changed hands. The correct move would be to cancel your order...not buy your own sell.

It raises an interesting issue, which is someone using the fee to increase perceived market volume.

sudoebm commented 3 years ago

AFAIK, there is nothing in the trade logic that says you can't buy/sell to yourself. Accordingly you should be charged a fee even though nothing changed hands. The correct move would be to cancel your order...not buy your own sell.

It raises an interesting issue, which is someone using the fee to increase perceived market volume.

Right, but should this be the case? Should we not prevent users from trading with themselves? Charging a fee for something seemingly pointless whether due to user error or ignorance seems like an ethical oversight. I would add also that removing the functionality all together could reduce the likelyhood of foul play and remove an attack vector.

What's to say that this bug doesnt crop up again in future changes and a user suddenly does have the ability to print currency?

bennytehcat commented 3 years ago

Generate an error saying that "...this action will cause you to trade with yourself, review existing orders?" And it either is Cancel, which drops your order, or "okay" takes you to the active order window?

tylerjohneddy commented 3 years ago

i think this is a separate issue and should be raised accordingly. and close this one if were happy

BKdilse commented 3 years ago

This no longer occurs. @ElectricDosh are you able to confirm please?

ElectricDosh commented 3 years ago

This no longer occurs. @ElectricDosh are you able to confirm please?

Yeah this seems to be solved. After the reset there was some kind of 0 value ghost order left in the books that allowed me to pull another XMR or so out of the aether, but I haven't been able to replicate it, think it must've been an artifact from the wipe.