1

Recently, a marketplace was said to have been reusing deposit addresses, such that clicking the "get new address" button would immediately give the user a different address, however, the "new address" was sometimes already funded.

Needless to say, this is terrible OPSEC, but I'm wondering how such an issue could arise. Is it a faulty implementation of BIP32? This seems more likely than reusing keypool addresses for bitcoind, but I'm curious how this issue could arise.

1

Keep in mind that the marketplace in question may not use bitcoind, and if they do, may not use it in the most sensible way. Some possibilities:

  • A list of addresses was generated. When it reaches the end of the list, it loops back to the beginning and reuses the old addresses, assuming that nobody should reuse their old one again. (this is a poor design: addresses should not be reused for privacy, and so that in case someone sends to an old address, you know whose is whose)
  • The addresses were generated with such low entropy that the same addresses were created and used again. (this is a serious security flaw in their setup)

In either case, it's possible that either...

  • the system records both accounts as owning the address (which is very bad, since you can both spend each other's money), or
  • only one of the accounts as owning the address. Which is very bad if the one owning it is the old one, since new funds are likely to be sent to the wrong person; or only slightly bad if the one owning it is the new one, since the old account owner may be inactive and should not reuse his old address anyway if he makes another deposit.

Regardless of the details (which you as a user aren't going to know anyway), it would make me very hesitant to use the marketplace, since it points to a dangerously sloppy design.

  • Thanks for the insight. I have it from a trustworthy source it is in an entropy issue, likely with BIP32 non hardened keys. Though I can't see how one could differentiate between BIP32 keys without having a private key to check all <2^31 indexes (unless of course the generated address pool matched what was actually used). Based on walletexplorer.com there's ~100 addresses reused up to 15 times each, FWIW – Wizard Of Ozzie Apr 15 '15 at 4:05
  • Also, without making this a "how to run a DNM" fracas, what other possibility for a Bitcoin daemon is there, besides a modified Bitcoincore implementation (bitcoind*/*bitcoin-cli) – Wizard Of Ozzie Apr 15 '15 at 4:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.