Sure, but if silk road waited for X confirmations, it would have made it at least a bit more complex to pull off.

(Maybe you could have just hammered it continuously, but hopefully would have to predict when the blocks would be confirmed. They’re not exactly every 10 minutes).

It’s not exactly related to this hack, but poor blockchain practice on the part of silk road if it permitted withdraws this quick after deposits.

If the bug is a read-modify-write sequence without a transaction, then regardless of whether you wait for more confirmations, the withdrawal action will always be racy and vulnerable to this exploit.

Not waiting for confirmations would leave you vulnerable to random chain forks and make 51% attacks cheaper.

From what they said it sounds like the issue was executing the same withdrawal request more than once, unrelated to the bitcoin confirmation window. The fraudulent withdrawals had to happen on the same second, not merely on the same hour.

That’s correct. I read the indictment and the first one was done within 5 seconds of deposit, while the next successful one was after 24 minutes.

> Very common in amateur coded websites.

Also common in professionally coded websites.

« Do not click PAY more than once »