A new BUG of Ethereum with send ETH without balance.

[haint87]

Hi there,

https://rinkeby.etherscan.io/address/0x6Ef57BE1168628A2bD6c5788322A41265084408a https://ropsten.etherscan.io/address/0x6Ef57BE1168628A2bD6c5788322A41265084408a

When I make a transaction (offline transaction by signTransaction and sendRawTransaction), I recognise transactions from another wallet without balance sent to this wallet 0x6Ef57BE1168628A2bD6c5788322A41265084408a. If transactions are made with high gasPrice(40.000.000.000) then ETH sending to 0x6Ef57BE1168628A2bD6c5788322A41265084408a is higher, followed by similar transactions with lower gasPrice (100.000, 10.000, 100, 0). Is it a mistake of Ethereum?

update:

1. Without balance: the source address wallet can send more ETH without balance, I tested in my testnet.
2. When you send transaction more gasPrice (eg: 1.000.000.000.000,....), more leaked ETH.
3. Hacker can create many wallets from nodes, end scan the nodes and start hijacking process.

please note that this is an issue tracker reserved for bug reports and feature requests.

For general questions please use the gitter channel or the Ethereum stack exchange at https://chat.stackexchange.com/rooms/75652/discussion-between-jackson-ng-and-smarx https://ethereum.stackexchange.com/questions/45008/eth-stolen-on-ropsten

System information

Geth version: 1.8.2 OS & Version: Windows/Linux/OSX Commit hash : (if develop)

Expected behaviour

Actual behaviour

Steps to reproduce the behaviour

Backtrace

[backtrace]

[haint87]

When you send with more gas attacker get more ETH (testnet). This is a real bug, but dev doesn't confirm it as a bug.

[karalabe]

@bradlucas According to Etherscan:

 Balance for 0xd60e64afb753583941e1ab42f836ced0d23af2db
At (Block#3179283) = 89.973741587469 Ether

https://ropsten.etherscan.io/balancecheck-tool?a=0xd60e64afb753583941e1ab42f836ced0d23af2db

[hadv]

yes, this account 0xd60e64afb753583941e1ab42f836ced0d23af2db received much mined reward 19 days ago before sending the 89ETH out. then it's not the problem.

https://ropsten.etherscan.io/address/0xd60e64afb753583941e1ab42f836ced0d23af2db#mine

[bradlucas]

@karalabe Thanks very much for pointing out the Balance Checker. I wasn't aware of that tool.

Also, @hadv I see now that we must have turned on mining for a bit. Your link shows that.

Thanks, both for clearing this up. Appreciate it.

[siong1987]

@haint87 i have been working on this PR that allows RPC server to set their own username and password by passing in --rpcuser and --rpcpassword. can you try it out with a username and a password to see whether the " bug" still persists? btw, once you set the username and the password, make sure that you authenticate your RPC calls with basic authentication headers: https://en.wikipedia.org/wiki/Basic_access_authentication

https://github.com/ethereum/go-ethereum/pull/16821

[marcosmartinez7]

@Tudmotu i tried to do that. I have tried to run 2 nodes, 1 of them with the rpc ports blocked and with the unlocked account, the other one has the rpc ports open but the account is locked.

The second node is just for interactions with metamas/myetherwallet/etc.

The thing is if i hit that 2nd node, since the account isnt unlocked, it can mine the blocks:

WARN [08-01|19:53:13.837] Block sealing failed err="authentication needed: password or unlock"

Is there a way to build a "safe proxy" or something like that? a node that you can access by rpc and it will send the transactions to the other node that can mine?

[Tudmotu]

@marcosmartinez7 I personally didn't look more into this issue, so can't help unfortunately... 😕

[Micpittser84]

why does it matter if its just on the test network and has no value anyway?