You are viewing a single comment's thread from:

RE: Market Smart Contract

in #hive-engine2 months ago

Beware the exploit lurking within Hive-Engine:

Hidden within Hive-Engine lies a devious flaw—a bug born of rounding errors. Exploit it effortlessly by manipulating transactions with a mere 0.00000001 SWAP.HIVE. In markets where spreads run narrow, your advantage grows.

Consider the SPS market, a prime specimen:
Sell 0.00000017 SPS at 0.02974381 SWAP.HIVE apiece, netting 5.0564477e-9. Hive-Engine rounds this up to 1e-8.
Simultaneously, purchase 0.00000049 SPS at 0.02999 SWAP.HIVE each, totaling 1.46951e-8, rounded down to 1e-8.

Thus, you sell 0.00000017 SPS and buy 0.00000049 SPS, with your SWAP.HIVE balance unchanged—yielding a profit of 3.2e-7 SPS per transaction.

Repeat this maneuver, and watch your profits grow exponentially.
Use this knowledge wisely.

Our diligent attempts to warn the developers about this exploit and present potential solutions repeatedly through various channels were met with silence.

Sort:  

Your attempts to exploit it yourself, plus this message, have now brought it to our attention. We will work on implementing a fix, either by putting in validation to prevent dust orders that would result in this rounding issue, or by increasing the minimum allowed order size.

I don't know what "various channels" you used to try to report this issue. We know of no attempts to do so. Simply reaching out to Aggroed or one of our active developers directly on Discord would have been a more constructive way of getting our attention than the approach you have evidently taken.