Mark Stair @markstair on Telegram has informed me that the Tipit Bot has been hacked due to a malicious dependency and 1,206,182.34 BOID tokens along with other EOS tokens were stolen from Tipit Bot users at tipit.io.
To be clear this is not a bug due to BOID code or smart contracts and this is isolated to Tipit Bot code. Mark Stair will post details below.
Should we reimburse Tipit Bot BOID token holders from the public worker funds?
Reimburse all stolen BOID tokens back to Tipit Bot users.
Hello, Mark Stair from tipitbot and tipit.io. Here are some details:
Late March 3 to Morning March 4, telegram users were able to exploit tipit due a failed nodejs library that was supposed to prevent simultaneous transactions.
Hackers were able to deposit some tokens, for example 200 BOID into their tipit account.
then they send/tip these tokens in up to 10 simultaneous transactions to another user. Now the new user would have balance of 2000 tokens. In some cases they did this multiple times.
Then once they go enough tokens up to the tipitaccount balance, they were able to withdraw from tipit. tipit was stopped as soon as the issue was discovered and is now on hold.
Telegram accounts involved in the exploit:
Trusky7
Dashingi
Jiminyu1
Cujimi
Results12
Tishum
Datafilhota
Cicimu
Xerjoi
Zuikol
Swagoi
“Koopjo”
tipit team is working on resolving this issue and will keep tipit in maintenance until the issue is fully resolved. We will provide details as they become available.
Note that currently all user balances are intact but the tipitaccount does not have adequate token funds to match user balances due to this exploit.
as this was not Boid fault I propose to fully reimburse all stolen BOID tokens back to Tipit Bot Users BUT have future Tipit charges for withdrawing BOID tokens from tipit cut in half. It would be fair to the community and to tipit bot team.
To elaborate a bit, the library was “promise-queue” in node.js - it is designed to only allow one concurrent function to run at a time (tips in this case), however it failed to do so and therefore users were able to send multiple tip actions, packaged in one transaction. We currently run under the assumption that there will be one tip per transaction/500ms block to keep balances in sync with the chain, without the queue library keeping the calls synchronous, the users listed flooded the system with tips to replicate what Mark S has described.
I am writing a dedicated call-handler in the back-end code (that talks to the balance data and the blockchain) to be sure that the calls are executing in order, and once per block, as well as adding additional checks to be sure that users cannot perform multiple functions before completing their previous one. Additionally, our social bots will have additional checks in place to prevent these calls from coming in on the front-end when possible.
1,206,182.34 BOID tokens is not a whole lot. Let Tipit Bot or some nice soul run a donation campaign for Tipit. If the community thinks it is a worthy cause, they should have little problem raising the funds needed to recoup their losses. I’d donate myself. Where can I donate to help? The worker fund is for a different cause. This would set a bad precedent, in my opinion.
Yes I agree, this is what I was thinking. Not fair to use public funds to help a private group. @mark@Gilser Where could the Boid community donate to Tipit?
Hello, thanks for the discussion.
I’d like to mention that tipit never charged BOID to get setup on tipit. Our 1% pull fee of tokens like BOID is not even enough to buy a cup of coffee, let alone run our operations. We have also not charged other token owners and we are entirely self-funded. Our goal with tipit is to help grow the eos/crypto space by allowing regular people to receive tokens on social platforms so they can get interested. The crypto market is pathetically small versus ROW and total money supply. So currently tipit is being run like a “gift economy” and we are continuing to update, tweak, work with the eos community, and try new things that can get eos to “cross the chasm” into mass adoption. When that happens, everyone in the eos ecosystem wins.
We can offer a couple other options:
There was a request to lower the 1% withdraw fee. Tipit could offer to make a custom update on pull fee on BOID tokens. We could propose from public fund of 50M BOID for 0.5% fee or 100M BOID for no withdraw fee.
We could also separately accept donations of BOID. Anyone that wants to donate can just send tokens to tipitaccount with a text memo or no memo, as long as it doesn’t include the userID information that would link into a user account. I’ll also donate whatever BOID we have. When the amount of BOID donated exceeds the stolen amount we can turn on withdraws. Any excess BOID received can be distributed to the community through tipit tips to continue to spread the word and get other people involved.
Thanks for the discussion. The tipit community has been great through this issue with most token owners replenishing the accounts. We really appreciate the support!
Mark Stair
I think lowering the fee until it can pay for 1206182.34 BOID that we donate from wpf would be great.
Anyone who would like to send some tokens to tipitaccount is most welcome of course.
I don’t have any boid to donate but I’m willing to forgive my balance on TipitBot, It was between 5 and 10k boid. Message me @mindspasm on Telegram if you need confirmation there.
