Spoiler (Click to View)

(Jul 29, 2014 01:51 PM)Google Chrome™ Wrote:  Someone had this problem when they were trying to send me OMC last night. Give it a hour or so

(Jul 29, 2014 02:08 PM)Abraham Lincoln Wrote:  Not to raise false alarm, but when the other 2 online wallets got hacked they did the same thing.

It could be that the wallet daemon has just crashed though, I'll take a look.

EDIT: Nope, the daemon appears to be fine, it's showing balances / transactions. Still looking around for any possible cause other than hacking.

(Jul 29, 2014 02:08 PM)Abraham Lincoln Wrote:  Not to raise false alarm, but when the other 2 online wallets got hacked they did the same thing.

It could be that the wallet daemon has just crashed though, I'll take a look.

EDIT: Nope, the daemon appears to be fine, it's showing balances / transactions. Still looking around for any possible cause other than hacking.

(Jul 29, 2014 02:22 PM)Abraham Lincoln Wrote:  Can anyone link me to some transactions that they sent into the wallet?

(Jul 29, 2014 02:24 PM)Vanish. Wrote:  This is a 5 OMC transaction that I sent from OMCWallet.com to my Offline Omniqoin-qt Wallet.
https://omnicha.in/?transaction=19e50d206196a065b54487708b5d96cce230408375e4e61e28430922860b5221

(Jul 29, 2014 02:24 PM)Vanish. Wrote:  This is a 5 OMC transaction that I sent from OMCWallet.com to my Offline Omniqoin-qt Wallet.
https://omnicha.in/?transaction=19e50d206196a065b54487708b5d96cce230408375e4e61e28430922860b5221
And when you look here: https://omnicha.in/?search=oMYtvYNA7cNBNoYsiqqeU96qQC65eb5WrH
That is my OMCWallet.com address it says I've send 2300 OMC, but I've actually only send small amounts of 5-10

(Jul 29, 2014 02:24 PM)Abraham Lincoln Wrote:  

---

Thanks, do you have any where you sent OMC into the online wallet from the offline wallet?

(Jul 29, 2014 06:35 PM)Abraham Lincoln Wrote:  It is definitely exploitable using the same method as the other wallets. I haven't tested it or exploited it, but from experience I'd say it is definitely possible.

I can't even withdraw 1 OMC from my account, I'd say it has all been stolen.

(Jul 30, 2014 05:59 AM)Doctor Blue Wrote:  I don't understand. Wasn't the bug in the other wallets that you could deposit 1 OMC and then withdraw more than you actually had? How can that possibly be hard to fix?
I'm confused.

(Jul 30, 2014 05:59 AM)Doctor Blue Wrote:  I don't understand. Wasn't the bug in the other wallets that you could deposit 1 OMC and then withdraw more than you actually had? How can that possibly be hard to fix?
I'm confused.

(Jul 30, 2014 06:26 AM)Abraham Lincoln Wrote:  The exploit is caused by the way the omnicoin wallet handles different accounts. Basically you link addresses with an account. When OMC is received from that address, it adds that to your account balance in the wallet. When sending OMC though the inputs used aren't from that address, they are from any input in the wallet. It's not the greatest way to do it, but it keeps the TX fees low.

It all works fine and dandy until a private key is leaked. Then that messes up the wallet. It assumes that only it has access to the private keys. Basically you deposit money into the online wallet, then withdraw it using the private key. The wallet doesn't count the withdrawal from the private key as a withdrawal from the account though and so your balance stays the same. Then you simply withdraw from the online wallet, rinse, and repeat. Basically doubling your OMC each time.

The other 2 wallets allowed exporting / importing of private keys, opening up a door to the exploit. OMCwallet didn't allow importing / exporting, but if you are clever there is a way to still get a private key.