http://developers.slashdot.org/story/14/02/11/0015242/surrogate-database-key-not-bitcoin-protocol-flaw-to-blame-for-mt-gox-problems

 

Few people believe that there is a flaw in BitCoin’s algorithm… it’s what people do with bitcoin transactions –> cash which is problematic.  Bitcoin exchanges are, of course, just more programs.  They need to see a successful transaction occur on the blockchain and when they do, they put some money in someone’s paypal account. 

Pretty simple.  (ignoring the whole blockchain p2p bitcoin network confusion, this is just take a message, process it, send money)

But there is a piece of this process which doesn’t actually have anything to do with the transaction (the amount, addresses, timestamp), it’s an id… which can be changed and forged…  and that gets these exchanges in trouble.  They are treating the transaction ID as a proof of success.  Storing it on their database before they ever get an “Okay” from the blockchain.  Then people are “complaining” that their transaction didn’t go through.  And instead of saying “Sorry, you’re right, it didn’t…please submit another one”, they’re saying “Oh, sorry about that, here’s your money”.  It’s refund fraud on a mass level.  It required humans to make decisions to allow things that shouldn’t have happened.

Drrrrr.

Had they used the natural key of the transaction, when the nefarious attempt to re-submit a second time occurred, it would be noted as a duplicate, and rejected. 

Natural keys are best.

 

This whole post was spawned from the expectation that Mt.Gox had this happen to them.  I doubt that however.  As it would’ve required thousands of failed transactions to be customer-serviced… someone should’ve seen something fishy.   As of 16 seconds ago, some hacker groups have determined that the CEO committed fraud and actually was the perpetrator.  MtGox data hacked and published, complete with Bitcoin wallet-stealing malware