okx / js-wallet-sdk

Multi-chain typescript signature sdk, supports bitcoin, ethereum, solana, cosmos, etc.
https://okx.github.io/js-wallet-sdk/#/
MIT License
211 stars 74 forks source link

Can you please explain how to handle the double spending vulnerability in the doginals protocol for the dog chain? #101

Closed HeroWdev closed 6 months ago

HeroWdev commented 6 months ago

The contributions of OKX in the field of blockchain are well-known among players and professionals. Therefore, when we learned that OKX is about to support the dog chain with the doginals protocol, which is a legitimate protocol, our team decided to establish a targeted trading market with a background in Dogecoin mining. We have been conducting research in this area for the past month. However, we heard rumors about a double spending vulnerability in the verydogelabs indexing method supported by OKX. During our research, we discovered some evidence supporting these rumors, indicating that some individuals have already taken advantage of this vulnerability in several existing markets, resulting in the loss of millions of Dogecoins. We would like to hear OKX's response and discuss how to address this vulnerability. If this issue is not resolved before the launch of OKX's web3 wallet or if we proceed with establishing a trading market without addressing the vulnerability, it could lead to significant losses for players and even affect OKX's reputation.

We have discovered several dozen addresses on the doggy.market trading platform that are exploiting a double-spending vulnerability by utilizing the verydogelabs index to continuously obtain free DRC20 tokens. These addresses then list these tokens for sale on the market, and each address is making substantial profits. Currently, the trading volume on the doggy market is not significant, but once DRC20 is listed on OKX, we can expect a significant increase in traffic and trading volume. At that point, it will become challenging to control the situation. Moreover, DRC20 has more potential than BRC20, with a larger player base, faster transaction speeds, and lower fees. Once this issue is resolved, we believe OKX will lead this sector comprehensively and be at the forefront of the industry.

Here are some addresses we found from several existing doginals trading markets,The owners of these addresses exploited the double spending vulnerability to acquire a large amount of dog chain doginals and then sell them on the market. These addresses have no minting records or purchase records; they only have records of receiving transfers and selling. Furthermore, these addresses represent only a portion of the issue. We have investigated the communities associated with some doginals and found no evidence of over-the-counter (OTC) trades; they were only traded on the market. Additionally, some players have reported losing a significant amount of their doginals, further confirming the existence of the double spending vulnerability. Currently, our technical team is attempting to verify the vulnerability by testing if our own addresses can be exploited. We hope that OKX will also test and resolve the double spending vulnerability before the launch of the DRC20, as this is crucial.

lianqing123 commented 6 months ago

https://github.com/dogexme/dogim-indexer This indexer is improved on the basis of doginals and solves the double spending vulnerability, so it is doginals+

anthonypeter1988 commented 6 months ago

You can check out the comment above. Dogim's index perfectly solves these vulnerabilities, and there are many Dogim players. If you can provide a trading market for Dogim, it will definitely be a win-win situation!

yanminmin commented 6 months ago

Thank you very much for reminding us that we use our own indexer and will also work with the relevant open source community. If you find any problem with our data, please kindly provide, thank you very much!

Refrain-123 commented 6 months ago

Thank you so much for your suggestion!All issues related to the security of user assets should be given high priority. In fact, we have previously discussed some issues with the team from Dogim, and it's unclear what the double-spending case you mentioned here entails. Could you please explain further?

abhimishra-dev commented 6 months ago

@yanminmin , hope you consider DOGIM index as well while integrating doginals from DRC-20 on OKX. We as a community are the bigger part of this DRC-20 ecology and I hope you don't want to lose us.