Author Topic: BitShares XT - Security against Market Manipulation FIND ATTACKS FOR TIPS  (Read 52572 times)

0 Members and 1 Guest are viewing this topic.

Offline MolonLabe

  • Full Member
  • ***
  • Posts: 58
    • View Profile
I have an attack idea.

1] Select a market,
 1a] for example lets choose BitBTC,
 1b] for consistency let's refer to the market price as units of "Bitshares per Bitcoin" ie (BS/BTC) ,
 1c] lets assume the Last traded market price was 500 Bitshares for each Bitcoin, or '500',
2] Place a huge Bid of the amount equal to all current Ask orders,
 2a] let's imagine this costs a total of "Z bitshares",
 2b] I am now betting that the value (BS/BTC) will go up, ie that a Bitcoin will be worth more than 500 Bitshares,
3] Place a new Ask order at a much higher price,
4] Place a new Bid order at this exact price, (this tricks BitSharesX into believing that the price has gone way, way up, say from 500 to 1000),
5] Force shorts to close out your position (as BitSharesX forces them to cover), by selling to you (at twice what you just paid).

Can even rinse-and-repeat this strategy with higher and higher prices.

Market depth makes this attack costlier, but simultaneously, more profitable, so a different type of solution may be required.
« Last Edit: March 11, 2014, 01:49:05 am by MolonLabe »

Offline toast

  • Hero Member
  • *****
  • Posts: 4001
    • View Profile
  • BitShares: nikolai
Ah ok, so we're on the same page.

Yeah I suggest people find a canonical denomination for each asset type and stick with it across all chains. It'd be hilarious if someone says "on this chain, GLD is 1kg" and then the market doesn't read his launch thread and pegs it to 1 oz.
Do not use this post as information for making any important decisions. The only agreements I ever make are informal and non-binding. Take the same precautions as when dealing with a compromised account, scammer, sockpuppet, etc.

Offline pariah99

  • Full Member
  • ***
  • Posts: 66
  • I'm so meta even this acronym.
    • View Profile
This is where I'm confused - this should never happen, unless the people who launched the chain clearly defined "GLD means 1/100kg of gold" vs "GLD means 1/1000kg of gold". I would assume people would think "GLD" means "1 oz 99.9%" which is standard for gold ETFs (I think?). Why would you expect the market peg to be so different on the different chains if they had the same properties?

This is getting a bit off topic, but my understanding was that the denominations of the share were going to be set by the chain creator.  If XA:USD an XB:USD were using denominations that varied by a factor of 10, I would expect the price to differ by a factor of 10 (all other things being equal).

I think the crux of the argument is whether or not denominations are going to vary between different chains of the same asset.  If the denomination is unchangeable at 1share=1oz, then everything I said is wrong.

Offline toast

  • Hero Member
  • *****
  • Posts: 4001
    • View Profile
  • BitShares: nikolai
To put it another way: Do you expect XA:USD and XB:USD to trade at 10x difference?
Do not use this post as information for making any important decisions. The only agreements I ever make are informal and non-binding. Take the same precautions as when dealing with a compromised account, scammer, sockpuppet, etc.

Offline toast

  • Hero Member
  • *****
  • Posts: 4001
    • View Profile
  • BitShares: nikolai
If each share of XA:GLD could be redeemed for 1/100kg of gold and each share of XB:GLD could be redeemed for 1/1000kg of gold (due to them being different chains)

This is where I'm confused - this should never happen, unless the people who launched the chain clearly defined "GLD means 1/100kg of gold" vs "GLD means 1/1000kg of gold". I would assume people would think "GLD" means "1 oz 99.9%" which is standard for gold ETFs (I think?). Why would you expect the market peg to be so different on the different chains if they had the same properties?
Do not use this post as information for making any important decisions. The only agreements I ever make are informal and non-binding. Take the same precautions as when dealing with a compromised account, scammer, sockpuppet, etc.

Offline pariah99

  • Full Member
  • ***
  • Posts: 66
  • I'm so meta even this acronym.
    • View Profile
I'm not sure what you're saying here:
Person A makes BTS-XA with an asset GLD and person B makes BTS-XB with an asset GLD. You're saying XA:GLD and XB:GLD will trade at different prices? If you mean the XA to XA:GLD ratio will be different from the XB to XB:GLD ratio, then I think you are right, since XA and XB will unlikely be exactly the same price in terms of USD. If you mean that XA:GLD will not trade 1:1 to XB:GLD (different USD price), then I disagree - unless the chains have different properties (like one pays interest or something) they should trade at about the same. If the market peg works, it should work on both chains.

Well, both really...  I was trying to illustrate the concept of how there can be different chains for the same class of asset (Gold).  I thought that BTSdac was confused regarding whether the same class of assets would have one price per share in terms of BTS (or USD, or any other asset really).  If each share of XA:GLD could be redeemed for 1/100kg of gold and each share of XB:GLD could be redeemed for 1/1000kg of gold (due to them being different chains), then 1 share of XA:GLD would PROBABLY not trade for 1 share of XB:GLD, unless XB:GLD had some obscenely great features like 10% interest rate, free beer, and puppies.

Offline toast

  • Hero Member
  • *****
  • Posts: 4001
    • View Profile
  • BitShares: nikolai
If the person were to make a completely different chain for their gold, then that's a different story:  If person A decides to sell 1kg gold and create 100 BTS-X:goldA and person B decides to sell 1kg gold and create 1000 BTS-X:goldB, then they would be DIFFERENT COINS.  One unit of BTS-X:goldA would not trade equally with one unit of BTS-X:goldB.

I'm not sure what you're saying here:
Person A makes BTS-XA with an asset GLD and person B makes BTS-XB with an asset GLD. You're saying XA:GLD and XB:GLD will trade at different prices? If you mean the XA to XA:GLD ratio will be different from the XB to XB:GLD ratio, then I think you are right, since XA and XB will unlikely be exactly the same price in terms of USD. If you mean that XA:GLD will not trade 1:1 to XB:GLD (different USD price), then I disagree - unless the chains have different properties (like one pays interest or something) they should trade at about the same. If the market peg works, it should work on both chains.
Do not use this post as information for making any important decisions. The only agreements I ever make are informal and non-binding. Take the same precautions as when dealing with a compromised account, scammer, sockpuppet, etc.

Offline pariah99

  • Full Member
  • ***
  • Posts: 66
  • I'm so meta even this acronym.
    • View Profile
The system has no way to identify a user with multiple positions because the concept of a user is outside the scope.   

A user who has a wallet with short and long positions will probably want to cover and combine his positions.
you know we usually say a function is convergence or divergence in area of mathematics
maybe we should consider if the system is convergence or divergence
different person created BTA with different ratio ,  but they exchange these in same market
it like , one person use 1kg gold cast 100 coins  another person use 1kg gold cast 1000 coins ,but all coins have same figure, and flow in same market, everyone tend to use equal gold to cast most coins.

maybe make creating process and selling process to be two independent process.  everybody create BTA with same ratio, also they can choice sell it or store it .
looking foreword  to your comments about this reply

Convergence/divergence in mathematics is a limit of a single function.  In economics, convergence is used colloquially to refer to the action of many rational actors acting in concert to reach a market equilibrium.  It's not really the same thing since you're talking about human psychology.

If you put something out there at a much higher price - nobody would buy it because there are a lot of sell orders at a lower asking price.  The person who is selling 1kg for 1000coins is not setting the price - he/she is ASKING for a price.

If the person were to make a completely different chain for their gold, then that's a different story:  If person A decides to sell 1kg gold and create 100 BTS-X:goldA and person B decides to sell 1kg gold and create 1000 BTS-X:goldB, then they would be DIFFERENT COINS.  One unit of BTS-X:goldA would not trade equally with one unit of BTS-X:goldB.

Offline BTSdac

  • Hero Member
  • *****
  • Posts: 1219
    • View Profile
  • BitShares: K1
The system has no way to identify a user with multiple positions because the concept of a user is outside the scope.   

A user who has a wallet with short and long positions will probably want to cover and combine his positions.
you know we usually say a function is convergence or divergence in area of mathematics
maybe we should consider if the system is convergence or divergence
different person created BTA with different ratio ,  but they exchange these in same market
it like , one person use 1kg gold cast 100 coins  another person use 1kg gold cast 1000 coins ,but all coins have same figure, and flow in same market, everyone tend to use equal gold to cast most coins.

maybe make creating process and selling process to be two independent process.  everybody create BTA with same ratio, also they can choice sell it or store it .
looking foreword  to your comments about this reply
github.com :pureland
BTS2.0 API :ws://139.196.37.179:8091
BTS2.0 API 数据源ws://139.196.37.179:8091

Offline bytemaster

The system has no way to identify a user with multiple positions because the concept of a user is outside the scope.   

A user who has a wallet with short and long positions will probably want to cover and combine his positions. 
For the latest updates checkout my blog: http://bytemaster.bitshares.org
Anything said on these forums does not constitute an intent to create a legal obligation or contract between myself and anyone else.   These are merely my opinions and I reserve the right to change them at any time.

Offline mf-tzo

  • Hero Member
  • *****
  • Posts: 1725
    • View Profile
Probably irrelevant and I am again missing something here but...

If I go long in x amount and then I go short in y amount this should lock a profit or loss for my self not affecting others...

If I am long 100 BitUSD and then I go short 50BitUSD effectively I am only long 50BitUSD. Since I am long there shouldn't be a need for collateral and vice versa if I was oveall short and it goes oposite I should cover with Bitshares collateral.

When a user takes oposite positions the system must recognise that these trades relate to the same user and match them in his account. Isn't that the case?


Offline Markus

  • Sr. Member
  • ****
  • Posts: 366
    • View Profile
A new solution for  The SIDS Attack, I think this solution is perfect.
Don't need time limit or deep limit or price limit for the whole BTS net.

We just need  to lock the transaction with create bitusd for 24 hours.
If margin call executed during the lock period, the only thing we need to do is change the output of this tranaction, give all backup xst to the bitusd buyer, destroy the  bitusd and short positions.

If someone issue themselves $1 billion BitUSD as a long position with a short position of $1 billion BitUSD backed by 1 BTS.  When margin call execute, the short positions should be coverd with these locked BitUSD, no BitUSD can be created.

This solution is from ssjpts.
如果锁定买卖双方的XTS-BITUSD这个单子1小时,出现爆仓的情况就需要买卖双方共同承担,也就是问题里说的万亿BITUSD也要爆仓。使得恶意购买BITUSD被市场共识瓦解。按5分钟一个块,1小时内有12个块。肯定会有相对合理的市场交易买卖,一但出现这样的买卖,都要对之前的买卖进行核对爆仓处理。这样不知道是否可行?

This would also mean that the newly created BitUSD could neither be spent (transferred to another address) nor the position closed within the first 24h. Not a very good idea in my opinion.

Offline Nimrod

  • Full Member
  • ***
  • Posts: 133
    • View Profile
A new solution for  The SIDS Attack, I think this solution is perfect.
Don't need time limit or deep limit or price limit for the whole BTS net.

We just need  to lock the transaction with create bitusd for 24 hours.
If margin call executed during the lock period, the only thing we need to do is change the output of this tranaction, give all backup xst to the bitusd buyer, destroy the  bitusd and short positions.

If someone issue themselves $1 billion BitUSD as a long position with a short position of $1 billion BitUSD backed by 1 BTS.  When margin call execute, the short positions should be coverd with these locked BitUSD, no BitUSD can be created.

This solution is from ssjpts.
如果锁定买卖双方的XTS-BITUSD这个单子1小时,出现爆仓的情况就需要买卖双方共同承担,也就是问题里说的万亿BITUSD也要爆仓。使得恶意购买BITUSD被市场共识瓦解。按5分钟一个块,1小时内有12个块。肯定会有相对合理的市场交易买卖,一但出现这样的买卖,都要对之前的买卖进行核对爆仓处理。这样不知道是否可行?
+5% +5% +5% +5% +5%
It is a good idea.  :)

Offline alt

  • Hero Member
  • *****
  • Posts: 2821
    • View Profile
  • BitShares: baozi
A new solution for  The SIDS Attack, I think this solution is perfect.
Don't need time limit or deep limit or price limit for the whole BTS net.

We just need  to lock the transaction with create bitusd for 24 hours.
If margin call executed during the lock period, the only thing we need to do is change the output of this tranaction, give all backup xst to the bitusd buyer, destroy the  bitusd and short positions.

If someone issue themselves $1 billion BitUSD as a long position with a short position of $1 billion BitUSD backed by 1 BTS.  When margin call execute, the short positions should be coverd with these locked BitUSD, no BitUSD can be created.

This solution is from ssjpts.
如果锁定买卖双方的XTS-BITUSD这个单子1小时,出现爆仓的情况就需要买卖双方共同承担,也就是问题里说的万亿BITUSD也要爆仓。使得恶意购买BITUSD被市场共识瓦解。按5分钟一个块,1小时内有12个块。肯定会有相对合理的市场交易买卖,一但出现这样的买卖,都要对之前的买卖进行核对爆仓处理。这样不知道是否可行?

Offline Ykw

  • Full Member
  • ***
  • Posts: 88
    • View Profile
Unfortunately I have been very busy with other things.. need to get back to code ASAP :)
+5%
Wish  to get bounty  before 2.28  ;D
Cheers, I have got 25 pts  :)

It might be strange for some people.. but it's important.. to say.. Thank you!... Glad bounties exist! this is a great incentive to make all investors care for the product.