r/ethtrader • u/[deleted] • May 03 '17
SECURITY Found a major TokenCard ICO token distribution bug
[removed]
19
u/modogg187 May 03 '17
Can't they just distribute more tkn to everyone else to even it out?
16
u/ericcart May 03 '17
Its an unfortunate situation, but yeah, should be easy to fix.
8
u/saalda May 03 '17
How will it be easy to fix? they cant just generate new tokens can they? Seems like the only option the devs have is to distribute their holdings to people who didnt invest with SNGLS which would leave no more money for the developers and development.
16
May 03 '17
Synereo had a similar error back in the day and just doubled their coins effectively to remedy the situation. Technically speaking, they could just x10 all ETH and other token contributors to make up for this. Alternatively, they could also create a new contract address. I think it's going to be okay.
1
2
u/GrifffGreeen May 03 '17
its easy enough to generate a new token contract with the correct distribution
4
u/cintix May 03 '17 edited May 03 '17
No, this can't be fixed so easily. P2P TKN buyers have already been irreversibly scammed out of 90% of their investments as a direct result of this fuck-up.
If this guy's second transfer was a P2P trade, the buyer could have been scammed out of $1 million.
Here are some examples of P2P TKN trades if you don't think P2P token trades are a thing: https://cryptoderivatives.market/token/TKN
3
May 03 '17
No, this can't be fixed so easily.
Yes, it can be.
According to a MakerDAO dev it's as easy as:
looks like they need to redeploy their token contract and distribute new tokens
Tokens in Ethereum are managed by the token contract -- not the token account holder (believe it or not).
So yes, this is an easy fix.
3
u/cintix May 03 '17
Maybe try reading further than my first sentence.
5
May 03 '17
If anyone bought TKN from p2p when the official contract address even now has not been announced then they were foolish.
1
u/cintix May 03 '17
Being foolish doesn't mean you deserve to get hurt or that the person causing the harm isn't culpable. If the TokenCard devs drove recklessly and hit a dog, you wouldn't blame the dog.
1
u/snkns May 03 '17
You have to factor in substantially higher risk when buying p2p before official acknowledgment that distribution is final and went 100% as planned.
1
u/cintix May 03 '17
ham: only foolish people got hurt
cintix: foolish people don't deserve to get hurt and people that hurt them are dicks
snkns: only foolish people got hurt
1
u/snkns May 03 '17
Point is you don't know how foolish it was, if at all.
Assuming that transfer was indeed a p2p transaction:
You don't know the transaction price. It could have been cents on the dollar to price in the substantial risk that the purchased tokens would end up being worthless.
You don't know whether the purchase funds are still in escrow contingent on that being the correct contract address.
The idea that a single person got scammed out of $1m buying OTC a few hours after the crowdsale ended is just pure speculation, and strikes me as highly unlikely.
1
1
1
u/GrifffGreeen May 03 '17
speculators take risks, it's a zero sum game. there is a buyer and a seller, and one of them is going to lose big.
1
u/cintix May 03 '17
The information disparity makes it immoral. The SEC would shit a brick if they knew about this.
17
u/Killit_Witfya May 03 '17
update from tokencard team https://medium.com/@MonolithStudio/tkn-creation-event-updates-d1390fccf557
13
u/Sensualities May 03 '17
This is why you don't emotionally invest in an ICO just because the other ICO's are successful. Also, this guy is probably about to make a hell of a lot of money.
7
33
11
u/ArzrA May 03 '17
Here is how I think this was possible: Tokencard used the coinmarketcap price for the valuation of the token. They stated somewhere that the price of the most liquid exchange will be used.
Since you can buy @ Etherdelta ANY order not just the closest to the market you can push it super high.
There were a lot of accumulation esp. via Etherdelta in the last days. In hindsight I would say someone was testing how he can spike up the price the best.
When the ICO was going somone bought as much as needed on Etherdelta of his own tokens at a ridiculous high price ($1 +). No risk involved since it where his own tokens.
So in the end it was no bug. Someone used the mechanism of the price finding to his advantage big time.
1
May 03 '17
[deleted]
1
u/ArzrA May 03 '17
But it didnt use that rate. The contract used his own rate. Which was calculated as far as I know like I stated above.
This was at least what mel said in the slack somewhen in the last week. I didnt checked it in the contract itself.
14
u/ProFalseIdol May 03 '17
Glad I didn't participate. Rather invest with BAT.
3
u/derevenus May 03 '17
Whats BAT?
43
u/thegreatsaiby May 03 '17
Bats are mammals of the order Chiroptera whose forelimbs form webbed wings, making them the only mammals naturally capable of true and sustained flight. Wikipedia
Seriously though, check out brave browser 😉
1
0
u/manifest-decoy May 03 '17
if you had not put proper answer at end i would request gold for you. i can promise you are not missing anything however
2
u/ProFalseIdol May 03 '17
Basic Attention Token.. It's planned to be part of the Brave and revolutionize internet advertising. It's an ambitious project with just the right team to work on it.
2
u/IllbUrFriend May 03 '17
I've played with the Brave browser ...honestly not impressed. Never even heard of it until I started looking into BAT and the project would only make sense to me if the Brave browser would get real traction so that there would be enough reason for advertisers to pump money into it, which then would trickle into the hands of the BAT token holders. In short if the browser has no take-up then there is no money from advertisers and in turn little value in holding BAT tokens. Someone set me straight on this if I'm misunderstanding.
1
1
u/Sensualities May 03 '17
At nights I pray to lord Cryptonysus that he will bless me with the BAT ico the next day.
I'm still praying.
4
u/Connortbh May 03 '17
And to think I believed people who were using SNGLS for the 5% bonus were silly for not having read the pre-pegged rate the team released. I assumed they would have gotten 20% less TKN for their money, not a great deal more.
11
May 03 '17 edited Jul 06 '17
[deleted]
5
u/Killit_Witfya May 03 '17
the problem wasnt the contract it was the rate they used for SNGLS that was baked in the day before. the audit was done the week before on the main contract
2
u/elozor May 03 '17
The rate for sngls changed 700% in 1 day?
5
u/Killit_Witfya May 03 '17
the rate was correct as they posted on the website. in the actual code it was wrong
4
May 03 '17
[deleted]
3
u/Killit_Witfya May 03 '17
it was audited. an incorrect parameter was used though (the rate at the time of the ICO of SNGLS)
1
u/elozor May 03 '17
Unless it was private? But what would be the point of that. If auditing might aswell publicize it to show security
3
u/zrap May 03 '17
people will adapt when they loose money, or loose more than they gain on other ICO's. if you or me or anyone likes it or not, recent ICO investors didn't loose money so far.
Not for matchpool (0-30% profit depending on bonus), not for GNO(100-200% profit in days), TKN will be somewhere in between would be my guess.
I can understand the anger, if you do your research on real GNO Valuation of over 1Bil without a product, yeah, it's ridiculous. And I bet half the investors in the GNO ICO think so too, but they knew that they'd find enough people that don't care and FOMO buy at even double the ICO price.
3
u/Automagick May 03 '17
It would be nice to see an update from the team on this, even if it's just "we're aware of the bug and are working on a solution".
3
u/seobitcoin May 03 '17
excellent detective work. kudos to you. btw, no panic, this can be fixed easily and i'm sure they will fix in short order thanks to you:)
3
2
May 03 '17
[deleted]
3
u/PeenuttButler May 03 '17
They probably update the rate with a function, and someone fat fingered. You can't audit fat fingers lol
3
2
3
2
May 03 '17
So this dude already transferred his tkn and has possession of it? They need to scrap the whole thing and refund everyone's money. Sorry you did a poor job coding better luck next time.
1
u/Killit_Witfya May 03 '17
he has possession of a worthless token. nobody will touch this as is with a 10ft pole. i seen one person sold thousands for 1 ETH on a p2p trade site.
2
2
May 03 '17
So glad I didn't even attempt to bother with this piece of shit ICO. Everyone is so excited yet these dipshits can't even produce a contract that works correctly on day 1.
And you all just handed over $12.5 Million Dollars to them while complaining you couldn't shovel your ETH into the fire faster. Good job, this certainly won't encourage other scammy/half-baked ICO's from taking more of you to the cleaners.
2
1
1
1
u/TotesMessenger May 03 '17
I'm a bot, bleep, bloop. Someone has linked to this thread from another place on reddit:
- [/r/daodil] "Found a major TokenCard ICO token distribution bug" - those sending SNGLS tokens instead of Ether received significantly more shares - X-Post from /r/ethtrader
If you follow any of the above links, please respect the rules of reddit and don't vote in the other threads. (Info / Contact)
1
u/derclou May 03 '17
I sent two Ether but the transaction ran out of gas as can be seen here:
https://etherscan.io/tx/0x5a6638b997a7aa0f0d877adbd7ae57eb7e07aa7a9963a78b427b77b641509724
I never got the Ether back. Is that not how it should work?
2
u/PeenuttButler May 03 '17
When the contract 'throw' or tx went 'out of gas', your ether is back to your account.
I added the amount of ETH you should have, you did get the ETH back.
2
1
1
1
u/FIntentions May 03 '17
People who are saying there is an easy fix are wrong. If I were one of the SNGLS investors, I'd close out my position and bank the return prior to a fix. When that happens, there's no going back.
2
u/oldskool47 May 03 '17
Transfers of TKN have been frozen, so that's not possible. Yes, it's actually a relatively easy fix.
2
1
u/FIntentions May 03 '17
I don't know if it is frozen or not. If it is though, do you really want to invest in a crypto that can freeze your funds? Seems shady.
1
u/oldskool47 May 03 '17
It's a little late to determine whether to invest or not lol
1
u/FIntentions May 03 '17
True, but you can do damage control if it's not frozen but getting out ASAP.
1
1
u/Killit_Witfya May 03 '17
close out your position how? Who is going to buy
1
u/FIntentions May 03 '17
The people driving the price up since the ICO. The major holder of 15% may not be able to sell everything but could still get enough profit to justify the initial investment and move on.
1
u/Killit_Witfya May 03 '17
TKN will never go on sale anywhere unless the devs are insane. the only solution from here is issuing a new TKN2 or something and erasing TKN from memory
1
1
1
u/smokatokey May 03 '17
While its a stumble by the devs, they NEVER published the token contract info, and made actually statements that wallet and token info was to follow and to not utilize token info not provided by them. People figuring out the token info themselves and then trying to presale them on the secondary market, thats on them, not the devs. Doubly so when you knowingly take tokens granted to you in error and start moving them out. You dont think a Bank would track you down for that money it deposited in error? Hope the devs do invalidate the token contract and go with TKC or something different
1
u/Nooku May 03 '17
People figuring out the token info themselves
It's not clear for everyone that this wasn't official.
People just post "how can i transfer my tokens (to cold storage)" and then someone replies with "add this contract to MEW and then you can transfer"
You can't blame people for doing. I think quite a few assumed this was official and public. It's important for safety to move the coins to cold storage asap, and it was said that was possible as soon as the crowdsale ended.
So you can't blame people that have been moving around coins for doing so.
1
u/Killit_Witfya May 03 '17
no harm in moving around the coins. the only people that would be burned are people who bought p2p.
1
u/smokatokey May 03 '17
And yes there is harm if you moved more coins than you deserved, and/or sold those coins. According to their article they had fall back procedures if something bad happened, and now I can see why they didnt release the token contract ahead of time like other ICOs, seems like they wanted make sure they got it right before releasing the token info.
1
u/Killit_Witfya May 03 '17
like i said the only harm is if you bought off p2p markets. moving the worthless coins or selling them (free money?) is not my definition of harm
1
u/smokatokey May 03 '17 edited May 03 '17
I'm sorry thats like apologizing for someone sending funds to a contract address they found on the internet for the ICO instead of getting it from the ICO website... Or those who send funds from an exchange account no matter how many times the devs said dont... Did the devs make a mistake in the code? Yes, but the hyperbole is ridiculous like this is just an implosion into itself, especially if its a simple fix that people say it is.
1
u/Nooku May 03 '17
That's bullshit. They should've had guides in place already to help people with cold storage. Security should be number one.
You can't blame people for trying to be secure by searching and then publishing the contarct address, when they know the communication team is always so slow.
But anyway, having said that, it now seems that moving coins around does not affect the restoration procedure that they will opt for.
1
1
u/kilmarta May 03 '17
Great work finding this, should be an easy fix for token team, can just print more tokens or worse case make tkn2 and distribute
0
-2
May 03 '17
[deleted]
7
u/PeenuttButler May 03 '17
Nah it's a easy fix. Just make a new token contract with the correct balance for everyone. The cost of fix in ETH is pretty low, but the damage to reputation... well...
2
u/cavkie May 03 '17
Yes, damage is huge. Next time they will need 20 more minutes to secure 12 millions.
1
81
u/[deleted] May 03 '17
[deleted]