The bug took place the 2nd of July 2019 at around 18:00PM.
We apologize to all affected customers. We are making sure it will not happen again.
Service should be back to normal within 4h after this post publish time.
@samotonakatoshi was the first person to give notice about the incident.
Reason
First of all, likwid was not hacked.
The reason was a bad coding practice. To be specific, a bad error handling.
All started when https://dev.steemit.com rpc node gave a random 502 bad request error. Likwid was set to re-invoke itself in such cases. That ended up with multiple Likwid instances running in parallel, which created an exponential endless loop of self-invoking likwid instances. Having that many asynchronous instances made impossible for the database and fail-safe features to prevent multiple redundant payouts.
Final result and lost balance
We found out about the issue quick enough and the server was brought down within the first 20min after the issue-trigger.
The following table contains the different likwid customer accounts who got multiple transfers.
author | STEEM | SBD |
---|---|---|
@cryptotokeneur | 0.66 | 0 |
@snuff1 | 0.52 | 0 |
@ | 54.339 | 19.452 |
15.725 | 5.628 | |
@ | 1.494 | 4.176 |
27.618 | 9.886 | |
70.457 | 25.222 | |
@elsiekjay | 0.607 | 0.217 |
153.472 | 54.938 | |
394.068 | 141.059 |
For all affected accounts, we would appreciate if you can send back the lost funds. Please let us know when funds are sent back. Thanks a lot in advance.
Methodology
For the sake of transparency and compliance, please find below the foresincs snippet code that has been used (nodeJS + dsteem library) to identify the lost founds:
async function forensics () {
var transfers = []
let history = await client.database.call('get_account_history', ['likwid', -1, 1000])
var duplicates = []
transfers = history.filter((x) => {return (x[1].op[0] == 'transfer' && x[1].op[1].from == 'likwid')}).map((x) => x[1].op[1])
const unique = [...new Set(transfers.map(item => item.to))]
for (let i = 0; i < transfers.length; i++) {
let el = transfers[i]
let _duplicates = transfers.filter((x) => { return x.to == el.to && x.amount == el.amount})
if (_duplicates.length > 1) {
duplicates.push(...new Set(_duplicates))
}
}
let final_duplicates = []
final_duplicates.push(...new Set(duplicates))
for (let i = 0; i < unique.length; i++) {
let author = unique[i]
let _transfers = final_duplicates.filter((x) => x.to == author)
if (_transfers.length > 1) {
console.log(author)
sbd_transfers = _transfers.filter((x) => getCurrency(x.amount) == 'SBD')
if (sbd_transfers.length > 1) {
sbd_transfers.shift()
total_sbd_debt = sbd_transfers.reduce((a, b) => { return { amount: parseFloat(a.amount) + parseFloat(b.amount) } })
console.log(parseFloat(total_sbd_debt.amount) + ' SBD')
}
steem_transfers = _transfers.filter((x) => getCurrency(x.amount) == 'STEEM')
if (steem_transfers.length > 1) {
steem_transfers.shift()
total_steem_debt = steem_transfers.reduce((a, b) => { return { amount: parseFloat(a.amount) + parseFloat(b.amount) } })
console.log(parseFloat(total_steem_debt.amount) + ' STEEM')
}
}
}
}
From what I can see I was paid twice for one post but then not paid for a later post.
This one was paid twice: https://steemit.com/@ura-soul/pkoshmbj
(25.222 SBD + 70.457 STEEM)
This one has not been paid: https://steempeak.com/@ura-soul/nkuppeoy
(23.575 SBD + 68.140 SP)
So I make that an outstanding balance that I need to pay of: 1.647SBD + 2.317 STEEM
It would be easier for me to just pay the final amount in SBD as I Powered up the liquid STEEM already. Let me know what you want to do.
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit
Hello, could you please join our discord likwid channel? https://discord.gg/YzAb4dS
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit
Sure, I am there.
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit
I just sent you direct message in discord.
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit
Payout has been released 3e2da86ee60621ce69a63aa371b402f1a89e61de
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit
@likwid will you please check my payout i have not get my payout from last 3 days ?
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit
Been trying to contact you in discord. Would you please join? Thanks a lot in advance.
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit
All pending payouts have been now released.
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit
I have returned the amount !
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit
Accounted.
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit
Tnq 🙂
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit
This post earned a total payout of 0.325$ and 0.244$ worth of author reward which was liquified using @likwid. To learn more.
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit
I think you got another bug, since you keep paying people who got flagged/downvoted, and your payout does not seem to take that into account.
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit
I have typed to discord channed. Still waiting for may response.
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit
Still waiting for my payment
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit
Rewards have been released.
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit
1,5%+1,5%=3%
bot is mistaken
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit
Hey there, I noticed you might have missed a post payout from my threespeak about 10 hours, could you check it for me? Thanks ^^
this one
screenshot of my wallet, seems to be missed.
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit