from Hacker News

Zerocoin implementation bug

by marksamman on 2/17/17, 10:05 PM with 134 comments

  • by josu on 2/17/17, 10:50 PM

    The current market cap of Zcoin is 1,538 BTC [0], so this person created 1/4 of all the coins in circulation (410 BTC), and these guys are saying: "We knew we were being attacked when we saw that the total mint transactions did not match up with the total spend transactions". It took them way too long to realize that they were being outsmarted.

    EDIT: u/aftbit also posted this on the thread: "They even cited the ability to detect hacks like this as a key advantage over Zcash. [1]"

    [0] https://coinmarketcap.com/currencies/zcoin/

    [1] http://blog.zcoin.tech/zcoin-and-zcash/

  • by fpgaminer on 2/17/17, 11:57 PM

    Let me get this straight. Zerocoin has a bug, money gets stolen, the bug is fixed. Everyone in the comments lose their shit and call doom and gloom for all cryptocurrencies. The experiment is failed, centralization was right all along!

    Meanwhile, centralized systems like credit cards are stolen en masse, identity theft abounds, anybody can file your taxes with the IRS and collect your refund, and an ACH can be initiated against your bank account using all the information helpfully printed on every check you hand to strangers... and no one bats an eye?

    I don't get it.

  • by wmf on 2/17/17, 10:24 PM

    What's better that stealing magic Internet money? Creating anonymous magic Internet money out of thin air, then selling it. Brilliant.

    But seriously, I'm not sure which is worse: Watching your stolen money move around the blockchain knowing you are helpless to do anything about it, or being provably unable to even tell the difference between "real" and "counterfeit" coins.

  • by arez on 2/17/17, 10:37 PM

    all these blockchain currencies seem to have really good bug bounty programs, this one gave out almost half a million dollars (410BTC)

  • by ianmiers on 2/18/17, 2:01 AM

    what went wrong: TLDR probably Ctrl-C,Ctrl-V.

    (Just to be clear, this is about Zcoin, not Zcash/Zerocash. The two are completely different)

    The fix is here. https://github.com/zcoinofficial/zcoin/commit/33796c839f7d4d... What happened?

    First, some stylized facts about ZCoin:

    0) ZCoin is a fork of Bitcoin that uses a 4 year old academic research library, libzerocoin, to make anonymous payments using the Zerocoin protocol.

    1) Unlike Zcash/Zerocash, the Zerocoin protocol has only fixed value coins.

    2) To get multiple denominations, you have completely separate instances of the anonymous currency that just happen to live on the same blockchain as the other denominations.

    3) Zerocoin has its own bitcoin like non anonymous base currency. Call it basecoin.

    4) You spend basecoins to get zerocoins.

    5) When you spend zerocoins, you get basecoins.

    6) ZQ_WILLIAMSON and ZQ_PEDERSEN are denominations, worth 100 and 50 respectively, defined in libzerocoin.

    So what went wrong?

    When you convert a zerocoin into 100 basecoin, the ZCoin code forked from bitcoin checked if the coin was a valid instance of ZQ_PEDERSEN (worth 50 ) not ZQ_WILLIAMSON (worth 100). So you paid 50 for the zcoin,got it into the instance for ZQ_PEDERSEN, but got back 100. Free money.

    Why did this happen? Well, it looks like in order to support the multiple denominations libzerocoin offers, the ZCoin developers wrote some code for one denomination and then duplicated it for each remaining denomination. There are five in total, ZQ_LOVELACE=1,ZQ_GOLDWASSER=10, ZQ_RACKOFF = 25, ZQ_PEDERSEN = 50,ZQ_WILLIAMSON = 100.

    But on the last one, ZQ_PEDERSEN was not changed to ZQ_WILLIAMSON in a few places. This caused the bug.

    Caveat: I have nothing to do with ZCoin. However, I am an author of the zerocoin protocol, libzerocoin, the zerocash protocol, and am involved with Zcash.

  • by desdiv on 2/17/17, 10:48 PM

    Anyone know which line of code they're talking about?

    I took a glance at their Github bug tracker and couldn't find any references to this bug.

    [0] https://github.com/zcoinofficial/zcoin/issues?q=is%3Aissue+i...

  • by ng12 on 2/17/17, 10:46 PM

    > A typographical error on a single additional character in code

    Really wonder what this was.

  • by Cyph0n on 2/17/17, 11:31 PM

    Exploiting such a tiny bug is damn impressive if you ask me. The bloke who pulled this off deserves the cash.

  • by hueving on 2/17/17, 10:25 PM

    >trading will resume once pools and exchanges have had time to update their code. A new release will be pushed out pretty soon.

    Does this imply this company has the power to stop all trading on the currency? If so, why would anyone ever want to use this?

  • by Entalpi on 2/18/17, 6:45 AM

    Finally money can have bugs.

  • by koolba on 2/17/17, 10:50 PM

    So who eats the loss for this?

  • by aftbit on 2/17/17, 10:30 PM

    Hmm, I know about Zcash and Monero, but I haven't read much about Zerocoin. I'll be staying away, especially after a 410 BTC hack. They even cited the ability to detect hacks like this as a key advantage over Zcash.

    http://blog.zcoin.tech/zcoin-and-zcash/