QuadrigaCX Contract Error - Revision history

Azoundria: Another 30 minutes complete. Additional sources merged in. Prevention completed. Information moved around. New logo image.

2023-11-29T21:50:09Z

Another 30 minutes complete. Additional sources merged in. Prevention completed. Information moved around. New logo image.

← Older revision		Revision as of 15:50, 29 November 2023
Line 1:		Line 1:
	{{~~Imported~~ Case Study~~\|source=https://www.quadrigainitiative.com/casestudy/quadrigacxcontracterror.php~~}}		{{Case Study Under Construction}}[[File:Quadrigacx.jpg\|thumb\|QuadrigaCX Website/Founder]]Quadriga Coin Exchange was Canada's leading cryptocurrency exchange. In 2017, the platform suffered an issue where Ethereum deposited into the smart contract hot wallet was unable to be accessed. The issue was caused by an upgrade in the Ethereum protocol, which required the prefix "0x" prior to addresses. The funds remain frozen in the smart contract. The Quadriga platform ultimately collapsed, however it is unclear the extent to which the lost Ethereum contributed.
	[[File:Quadrigacx.jpg\|thumb\|QuadrigaCX]]Quadriga Coin Exchange was Canada's leading cryptocurrency exchange. In 2017, the platform suffered an issue where Ethereum deposited into the smart contract hot wallet was unable to be accessed. The issue was caused by an upgrade in the Ethereum protocol, which required the prefix "0x" prior to addresses. The funds remain frozen in the smart contract. The Quadriga platform ultimately collapsed, however it is unclear the extent to which the lost Ethereum contributed.
			For logo:<ref>https://blockonomi.com/dead-quadrigacx-founder-lost-80-million-bitcoin/ (Nov 29, 2023)</ref>

	== About QuadrigaCX ==		== About QuadrigaCX ==

	QuadrigaCX was widely considered to be the Canadian exchange with the highest liquidity. At the time of the smart contract incident, QuadrigaCX was even described as "the only exchange in Canada"<ref name=":6" />.		QuadrigaCX was widely considered to be the Canadian exchange with the highest liquidity. At the time of the smart contract incident, QuadrigaCX was even described as "the only exchange in Canada"<ref name=":6" />.

	~~The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.~~

	~~Include:~~

	* Known history of when and how the service was started.
	* What problems does the company or service claim to solve?
	* What marketing materials were used by the firm or business?
	* Audits performed, and excerpts that may have been included.
	* Business registration documents shown (fake or legitimate).
	* How were people recruited to participate?
	* Public warnings and announcements prior to the event.

	~~Don't Include:~~
	* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
	* Anything that wasn't reasonably knowable at the time of the event.
	~~There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.~~

	=== Early Interview With Gerald Cotten ===		=== Early Interview With Gerald Cotten ===
Line 238:		Line 222:
	== Ultimate Outcome ==		== Ultimate Outcome ==
	The smart contract incident did not cause any noted losses at the time, however it did reduce the amount of Ethereum on the QuadrigaCX balance sheet, and could be argued to contribute towards the ultimate collapse of the platform in 2019.		The smart contract incident did not cause any noted losses at the time, however it did reduce the amount of Ethereum on the QuadrigaCX balance sheet, and could be argued to contribute towards the ultimate collapse of the platform in 2019.

	~~What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?~~

	=== Users Reported Successful Withdrawals ===		=== Users Reported Successful Withdrawals ===
Line 251:		Line 233:

	There do not appear to have been any funds recovered in this case.		There do not appear to have been any funds recovered in this case.

	~~What funds were recovered? What funds were reimbursed for those affected users?~~

	== Ongoing Developments ==		== Ongoing Developments ==
	~~What parts of this case are still remaining to be concluded?~~		There have been some proposals to modify the Ethereum protocol to allow the Ethereum to be extracted from the smart contract, however as of yet nothing has been implemented.
	~~==General Prevention Policies==~~
	It’s easy to forget the level of trust that Quadriga had in the market. The top upvoted comment reads “thank you for the statement and transparency and sharing all details”. Given failures and many hacking incidents, smart contracts should in general not be relied upon, and an exchange should always have ~~redundancy and auditing checks built in for every single system. While~~ some ~~issues may be seen as inevitable, having an issue persist for 3 days without being noticed is troubling. While there are many steps which could have been taken~~ to ~~prevent or notice~~ the ~~issue sooner, and this incident did contribute~~ to the ~~depletion of reserves, it’s not the reason anyone ultimately lost their funds. This type of failure is very challenging~~ to ~~regulate, already in~~ the ~~best interest of the exchange to avoid~~, ~~and rare compared to other types~~ of ~~failures which can occur. The exchange needs to transparently cover this shortfall, with the assistance of any hot wallet insurance.~~

	and an exchange should always have redundancy and auditing checks built in for every single system. While some issues may be seen as inevitable, having an issue persist for 3 days without being noticed is troubling. While there are many steps which could have been taken to prevent or notice the issue sooner, and this incident did contribute to the depletion of reserves, it’s not the reason anyone ultimately lost their funds. This type of failure is very challenging to regulate, already in the best interest of the exchange to avoid, and rare compared to other types of failures which can occur. The exchange needs to transparently cover this shortfall, with the assistance of any hot wallet insurance.
	==Individual Prevention Policies==		==Individual Prevention Policies==
	While individuals did not directly interact with the Quadriga Coin Exchange smart contract, they directly had control over the amount of funds that they transacted at any given time. In this particular case, no individual funds were lost, as the Quadriga platform officially covered the losses.		While individuals did not directly interact with the Quadriga Coin Exchange smart contract, they directly had control over the amount of funds that they transacted at any given time. In this particular case, no individual funds were lost, as the Quadriga platform officially covered the losses.

			{{Prevention:Individuals:Avoid Third Party Custodians}}

			{{Prevention:Individuals:Double Check Transactions}}

	{{Prevention:Individual:Store Funds Offline}}		{{Prevention:Individual:Store Funds Offline}}
Line 267:		Line 247:
	{{Prevention:Individuals:End}}		{{Prevention:Individuals:End}}
	==Platform Prevention Policies==		==Platform Prevention Policies==
	Smart contracts should be avoided unless necessary, and any smart contracts used should be subject to multiple third party security audits.		Smart contracts should be avoided unless necessary, and any smart contracts used should be subject to multiple third party security audits. Given failures and many hacking incidents, smart contracts should in general not be relied upon, and an exchange should always have redundancy and auditing checks built in for every single system. While some issues may be seen as inevitable, systems should be in place to ensure that issues are detected within 3 days.

	{{Prevention:Platforms:Regular Audit Procedures}}		{{Prevention:Platforms:Regular Audit Procedures}}

			{{Prevention:Platforms:Establish Industry Insurance Fund}}

	{{Prevention:Platforms:End}}		{{Prevention:Platforms:End}}
	==Regulatory Prevention Policies==		==Regulatory Prevention Policies==
	{{Prevention:Platforms:Regular Audit Procedures}}		{{Prevention:Platforms:Regular Audit Procedures}}

			{{Prevention:Regulators:Establish Industry Insurance Fund}}

	{{Prevention:Regulators:End}}		{{Prevention:Regulators:End}}

Azoundria at 21:17, 29 November 2023

2023-11-29T21:17:59Z

← Older revision		Revision as of 15:17, 29 November 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/quadrigacxcontracterror.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/quadrigacxcontracterror.php}}
			[[File:Quadrigacx.jpg\|thumb\|QuadrigaCX]]Quadriga Coin Exchange was Canada's leading cryptocurrency exchange. In 2017, the platform suffered an issue where Ethereum deposited into the smart contract hot wallet was unable to be accessed. The issue was caused by an upgrade in the Ethereum protocol, which required the prefix "0x" prior to addresses. The funds remain frozen in the smart contract. The Quadriga platform ultimately collapsed, however it is unclear the extent to which the lost Ethereum contributed.
	Quadriga Coin Exchange was Canada's leading cryptocurrency exchange. In 2017, the platform suffered an issue where Ethereum deposited into the smart contract hot wallet was unable to be accessed. The issue was caused by an upgrade in the Ethereum protocol, which required the prefix "0x" prior to addresses. The funds remain frozen in the smart contract. The Quadriga platform ultimately collapsed, however it is unclear the extent to which the lost Ethereum contributed.

	== About QuadrigaCX ==		== About QuadrigaCX ==

Azoundria: Introduction and prevention expanded.

2023-05-15T21:40:40Z

Introduction and prevention expanded.

← Older revision		Revision as of 15:40, 15 May 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/quadrigacxcontracterror.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/quadrigacxcontracterror.php}}

			Quadriga Coin Exchange was Canada's leading cryptocurrency exchange. In 2017, the platform suffered an issue where Ethereum deposited into the smart contract hot wallet was unable to be accessed. The issue was caused by an upgrade in the Ethereum protocol, which required the prefix "0x" prior to addresses. The funds remain frozen in the smart contract. The Quadriga platform ultimately collapsed, however it is unclear the extent to which the lost Ethereum contributed.
	~~This~~ exchange or platform ~~is based~~ in ~~Canada~~, or the ~~incident targeted people primarily~~ in ~~Canada~~.

	== About QuadrigaCX ==		== About QuadrigaCX ==
Line 217:		Line 216:

	== Immediate Reactions ==		== Immediate Reactions ==
			It’s easy to forget the level of trust that Quadriga had in the market. The top upvoted comment reads “thank you for the statement and transparency and sharing all details”. Given failures and many hacking incidents, smart contracts should in general not be relied upon, and an exchange should always have redundancy and auditing checks built in for every single system. While some issues may be seen as inevitable, having an issue persist for 3 days without being noticed is troubling. While there are many steps which could have been taken to prevent or notice the issue sooner, and this incident did contribute to the depletion of reserves, it’s not the reason anyone ultimately lost their funds. This type of failure is very challenging to regulate, already in the best interest of the exchange to avoid, and rare compared to other types of failures which can occur. The exchange needs to transparently cover this shortfall, with the assistance of any hot wallet insurance.

	=== Community Reactions Prior To Announcement ===		=== Community Reactions Prior To Announcement ===
Line 259:		Line 259:
	==General Prevention Policies==		==General Prevention Policies==
	It’s easy to forget the level of trust that Quadriga had in the market. The top upvoted comment reads “thank you for the statement and transparency and sharing all details”. Given failures and many hacking incidents, smart contracts should in general not be relied upon, and an exchange should always have redundancy and auditing checks built in for every single system. While some issues may be seen as inevitable, having an issue persist for 3 days without being noticed is troubling. While there are many steps which could have been taken to prevent or notice the issue sooner, and this incident did contribute to the depletion of reserves, it’s not the reason anyone ultimately lost their funds. This type of failure is very challenging to regulate, already in the best interest of the exchange to avoid, and rare compared to other types of failures which can occur. The exchange needs to transparently cover this shortfall, with the assistance of any hot wallet insurance.		It’s easy to forget the level of trust that Quadriga had in the market. The top upvoted comment reads “thank you for the statement and transparency and sharing all details”. Given failures and many hacking incidents, smart contracts should in general not be relied upon, and an exchange should always have redundancy and auditing checks built in for every single system. While some issues may be seen as inevitable, having an issue persist for 3 days without being noticed is troubling. While there are many steps which could have been taken to prevent or notice the issue sooner, and this incident did contribute to the depletion of reserves, it’s not the reason anyone ultimately lost their funds. This type of failure is very challenging to regulate, already in the best interest of the exchange to avoid, and rare compared to other types of failures which can occur. The exchange needs to transparently cover this shortfall, with the assistance of any hot wallet insurance.

			and an exchange should always have redundancy and auditing checks built in for every single system. While some issues may be seen as inevitable, having an issue persist for 3 days without being noticed is troubling. While there are many steps which could have been taken to prevent or notice the issue sooner, and this incident did contribute to the depletion of reserves, it’s not the reason anyone ultimately lost their funds. This type of failure is very challenging to regulate, already in the best interest of the exchange to avoid, and rare compared to other types of failures which can occur. The exchange needs to transparently cover this shortfall, with the assistance of any hot wallet insurance.
	==Individual Prevention Policies==		==Individual Prevention Policies==
	{{Prevention:~~Individuals~~:~~Placeholder~~}}		While individuals did not directly interact with the Quadriga Coin Exchange smart contract, they directly had control over the amount of funds that they transacted at any given time. In this particular case, no individual funds were lost, as the Quadriga platform officially covered the losses.

			{{Prevention:Individual:Store Funds Offline}}

	{{Prevention:Individuals:End}}		{{Prevention:Individuals:End}}
	==Platform Prevention Policies==		==Platform Prevention Policies==
	{{Prevention:Platforms:~~Placeholder~~}}		Smart contracts should be avoided unless necessary, and any smart contracts used should be subject to multiple third party security audits.

			{{Prevention:Platforms:Regular Audit Procedures}}

	{{Prevention:Platforms:End}}		{{Prevention:Platforms:End}}
	==Regulatory Prevention Policies==		==Regulatory Prevention Policies==
	{{Prevention:~~Regulators~~:~~Placeholder~~}}		{{Prevention:Platforms:Regular Audit Procedures}}

	{{Prevention:Regulators:End}}		{{Prevention:Regulators:End}}

Azoundria: New sections, more time there.

2023-05-15T17:13:42Z

New sections, more time there.

← Older revision		Revision as of 11:13, 15 May 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/quadrigacxcontracterror.php}}It’s easy to forget the level of trust that Quadriga had in the market. The top upvoted comment reads “thank you for the statement and transparency and sharing all details”. Given failures and many hacking incidents, smart contracts should in general not be relied upon, and an exchange should always have redundancy and auditing checks built in for every single system. While some issues may be seen as inevitable, having an issue persist for 3 days without being noticed is troubling. While there are many steps which could have been taken to prevent or notice the issue sooner, and this incident did contribute to the depletion of reserves, it’s not the reason anyone ultimately lost their funds. This type of failure is very challenging to regulate, already in the best interest of the exchange to avoid, and rare compared to other types of failures which can occur. The exchange needs to transparently cover this shortfall, with the assistance of any hot wallet insurance.		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/quadrigacxcontracterror.php}}


	This exchange or platform is based in Canada, or the incident targeted people primarily in Canada.		This exchange or platform is based in Canada, or the incident targeted people primarily in Canada.
Line 256:		Line 257:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			==General Prevention Policies==
			It’s easy to forget the level of trust that Quadriga had in the market. The top upvoted comment reads “thank you for the statement and transparency and sharing all details”. Given failures and many hacking incidents, smart contracts should in general not be relied upon, and an exchange should always have redundancy and auditing checks built in for every single system. While some issues may be seen as inevitable, having an issue persist for 3 days without being noticed is troubling. While there are many steps which could have been taken to prevent or notice the issue sooner, and this incident did contribute to the depletion of reserves, it’s not the reason anyone ultimately lost their funds. This type of failure is very challenging to regulate, already in the best interest of the exchange to avoid, and rare compared to other types of failures which can occur. The exchange needs to transparently cover this shortfall, with the assistance of any hot wallet insurance.
			==Individual Prevention Policies==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}
			==Platform Prevention Policies==
			{{Prevention:Platforms:Placeholder}}

	== Prevention Policies ==		{{Prevention:Platforms:End}}
	~~Coming soon.~~		==Regulatory Prevention Policies==
			{{Prevention:Regulators:Placeholder}}

			{{Prevention:Regulators:End}}
	== References ==		== References ==
	<references>		<references>

Azoundria at 17:09, 15 May 2023

2023-05-15T17:09:50Z

← Older revision		Revision as of 11:09, 15 May 2023
Line 262:		Line 262:
	== References ==		== References ==
	<references>		<references>
	<ref name="messari-81">[https://messari.io/article/new-documents-link-quadrigacx-founders-to-liberty-reserve-money-laundering-operation Messari - Bitcoin & crypto price, news, charts, and research] (Feb 14, 2020)</ref>
	<ref name="kylegibson-86">[https://medium.com/@kylegibson/100-crypto-thefts-a-timeline-of-hacks-glitches-exit-scams-and-other-lost-cryptocurrency-873c87fd5522 100 Crypto Thefts: A Timeline of Hacks, Glitches, Exit Scams, and other Lost Cryptocurrency Incidents] (Jan 25, 2020)</ref>		<ref name="kylegibson-86">[https://medium.com/@kylegibson/100-crypto-thefts-a-timeline-of-hacks-glitches-exit-scams-and-other-lost-cryptocurrency-873c87fd5522 100 Crypto Thefts: A Timeline of Hacks, Glitches, Exit Scams, and other Lost Cryptocurrency Incidents] (Jan 25, 2020)</ref>
	<ref name="bitcoinexchangeguide-218">[https://bitcoinexchangeguide.com/bitcoin/scams-hacks/ Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com] (Mar 5, 2020)</ref>		<ref name="bitcoinexchangeguide-218">[https://bitcoinexchangeguide.com/bitcoin/scams-hacks/ Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com] (Mar 5, 2020)</ref>

Azoundria: Another 30 minutes.

2023-05-08T18:53:00Z

Another 30 minutes.

← Older revision		Revision as of 12:53, 8 May 2023
Line 5:		Line 5:
	== About QuadrigaCX ==		== About QuadrigaCX ==

			QuadrigaCX was widely considered to be the Canadian exchange with the highest liquidity. At the time of the smart contract incident, QuadrigaCX was even described as "the only exchange in Canada"<ref name=":6" />.

	~~This~~ exchange ~~or platform is based in Canada~~, or the ~~incident targeted people primarily~~ in Canada.

	The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.		The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.
Line 103:		Line 101:
	On March 18th, 2016, Quadriga FinTech Solutions Corp. announced that one more of its directors, Bill Filtness, and CFO Natasha Tsai, had resigned from their positions. The company stated it was currently searching for new directors to fill the vacancies<ref name=":5" />.<blockquote>TORONTO – (March 18, 2016) Quadriga FinTech Solutions Corp. (the “Company”) announces that as Bill Filtness and Natasha Tsai have resigned as Director and Chief Financial Officer of the Company. The board of directors is currently conducting a search to fill the vacant roles and would like to thank both Mr. Filtness and Ms. Tsai for their efforts and contributions to the Company.</blockquote>		On March 18th, 2016, Quadriga FinTech Solutions Corp. announced that one more of its directors, Bill Filtness, and CFO Natasha Tsai, had resigned from their positions. The company stated it was currently searching for new directors to fill the vacancies<ref name=":5" />.<blockquote>TORONTO – (March 18, 2016) Quadriga FinTech Solutions Corp. (the “Company”) announces that as Bill Filtness and Natasha Tsai have resigned as Director and Chief Financial Officer of the Company. The board of directors is currently conducting a search to fill the vacant roles and would like to thank both Mr. Filtness and Ms. Tsai for their efforts and contributions to the Company.</blockquote>

			=== Smart Contract Security Flaws ===

	~~This sections is included if a case involved deception or information that was unknown at the time. Examples include:~~
	* When the service was actually started (if different than the "official story").
	* Who actually ran a service and their own personal history.
	* How the service was structured behind the scenes. (For example, there was no "trading bot".)
	* Details of what audits reported and how vulnerabilities were missed during auditing.
	The issue with the smart contract was described in the statement which was released by QuadrigaCX<ref name="reddit-233" />.<blockquote>In order to call a function in an Ethereum contract, we need to work out its signature. For that we take the HEX form of the function name and feed it to Web3 SHA3. The Web3 SHA3 implementation requires the Hex value to be prefixed with 0x - optional until Geth 1.5.6.		The issue with the smart contract was described in the statement which was released by QuadrigaCX<ref name="reddit-233" />.<blockquote>In order to call a function in an Ethereum contract, we need to work out its signature. For that we take the HEX form of the function name and feed it to Web3 SHA3. The Web3 SHA3 implementation requires the Hex value to be prefixed with 0x - optional until Geth 1.5.6.

Line 176:		Line 170:
	\|-		\|-
	\|June 2nd, 2017 5:36:48 AM MDT		\|June 2nd, 2017 5:36:48 AM MDT
	\|~~Details Posted on~~ Reddit		\|QuadrigaCX Posts Detailed Reddit Post
	\|The QuadrigaCX platform posts details about the incident to Reddit. They report an issue with their sweeping process for incoming Ether, causing a significant amount of Ether to be trapped in a splitter contract due to a failed transfer to the hot wallet. The problem occurred after upgrading from Geth 1.5.3 to 1.5.9. The issue was related to the prefixing of the Hex string in the Web3 SHA3 implementation. The contract was called with an invalid data payload, resulting in the trapped ETH. The problem has been resolved, and recoverability could be addressed through an amendment to EIP 156. While this setback has impacted QuadrigaCX's profits, it does not affect account funding, withdrawals, or the exchange's day-to-day operations. All withdrawals, including Ether, are being processed normally, and client balances remain unaffected<ref name="reddit-233" />.		\|The QuadrigaCX platform posts details about the incident to Reddit. They report an issue with their sweeping process for incoming Ether, causing a significant amount of Ether to be trapped in a splitter contract due to a failed transfer to the hot wallet. The problem occurred after upgrading from Geth 1.5.3 to 1.5.9. The issue was related to the prefixing of the Hex string in the Web3 SHA3 implementation. The contract was called with an invalid data payload, resulting in the trapped ETH. The problem has been resolved, and recoverability could be addressed through an amendment to EIP 156. While this setback has impacted QuadrigaCX's profits, it does not affect account funding, withdrawals, or the exchange's day-to-day operations. All withdrawals, including Ether, are being processed normally, and client balances remain unaffected<ref name="reddit-233" />.
	\|-		\|-
Line 182:		Line 176:
	\|Post Praising Transparency		\|Post Praising Transparency
	\|A response to the incident praises QuadrigaCX for their high level of transparency and explains the technical details of what happened<ref name=":0">[https://old.reddit.com/r/ethereum/comments/6ettq5/statement_on_quadrigacx_ether_contract_error/diczafr/ MyCrypto Taylor - "First thank you for the statement and transparency and sharing all details." - Reddit] (Apr 5, 2023)</ref>.		\|A response to the incident praises QuadrigaCX for their high level of transparency and explains the technical details of what happened<ref name=":0">[https://old.reddit.com/r/ethereum/comments/6ettq5/statement_on_quadrigacx_ether_contract_error/diczafr/ MyCrypto Taylor - "First thank you for the statement and transparency and sharing all details." - Reddit] (Apr 5, 2023)</ref>.
			\|-
			\|June 2nd, 2017 6:47:38 PM MDT
			\|Successful Withdrawal Reports
			\|User canadense1 reports successfully completing an Ethereum withdrawal<ref name=":7">[https://old.reddit.com/r/BitcoinCA/comments/6esvv5/quadrigacx_did_you_just_lose_17_million_cad/die05gk/ Canadense1 - "We did a 0.3 BTC withdrawal from QuadrigaCX at 1755h EST today (2 June 2017) and it cleared through in good time with multiple confirmations." - Reddit] (May 8, 2023)</ref>.
	\|-		\|-
	\|June 2nd, 2017 12:00:01 PM MDT		\|June 2nd, 2017 12:00:01 PM MDT
Line 201:		Line 199:

	== Technical Details ==		== Technical Details ==
			<ref name="reddit-233" />

			In order to call a function in an Ethereum contract, we need to work out its signature. For that we take the HEX form of the function name and feed it to Web3 SHA3. The Web3 SHA3 implementation requires the Hex value to be prefixed with 0x - optional until Geth 1.5.6.

			Our code didn't prefix the Hex string with 0x and when we upgraded Geth from 1.5.3 to 1.5.9 on the 24th of May, the SHA3 function call failed and our sweeper process then called the contract with an invalid data payload resulting in the ETH becoming trapped.

			As far as recoverability is concerned, EIP 156 (<nowiki>https://github.com/ethereum/EIPs/issues/156</nowiki>) could be amended to cover the situation where a contract holds funds and has no ability to move them.

			<ref name="reddit-236" />

			All over the ETH reddit says you guys screwed up your SafeConditionalHFTransfer without a function and users keep deposit ETH which is sent to an address that's unrecoverable.
	== Total Amount Lost ==		== Total Amount Lost ==
	The Crypto Theft Timeline reports the total loss as 60000 "Crypto", which likely indicates 60,000 ethereum<ref name="kylegibson-86" />. The BitcoinExchangeGuide also lists the amount of the loss as 60,000 ethereum<ref name="bitcoinexchangeguide-218" />.		The Crypto Theft Timeline reports the total loss as 60000 "Crypto", which likely indicates 60,000 ethereum<ref name="kylegibson-86" />. The BitcoinExchangeGuide also lists the amount of the loss as 60,000 ethereum<ref name="bitcoinexchangeguide-218" />.

	The total amount lost has been estimated at $14,700,000 USD.		The total amount lost has been estimated at $14,700,000 USD.

	~~How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?~~

	== Immediate Reactions ==		== Immediate Reactions ==
Line 218:		Line 224:
	client deposit to 0xf8cf56df660b655cb913931ddb10fbd25ec5df82 and the exchange redirects to 0x027BEEFcBaD782faF69FAD12DeE97Ed894c68549 but due to an error in their code they did not call the right function and the 4 ether is trapped in the contract		client deposit to 0xf8cf56df660b655cb913931ddb10fbd25ec5df82 and the exchange redirects to 0x027BEEFcBaD782faF69FAD12DeE97Ed894c68549 but due to an error in their code they did not call the right function and the 4 ether is trapped in the contract

	there are many such tx in the last few days from many addresses but with this same error</blockquote>		there are many such tx in the last few days from many addresses but with this same error</blockquote>Prior to QuadrigaCX posting an update, some users on Reddit described their anxiety<ref>[https://old.reddit.com/r/BitcoinCA/comments/6esvv5/quadrigacx_did_you_just_lose_17_million_cad/dicxw0u/ James Willett - "The silence is deafening..." - Reddit] (May 8, 2023)</ref>.<blockquote>The silence is deafening...</blockquote>

	=== QuadrigaCX Posts Reddit Announcement ===		=== QuadrigaCX Posts Reddit Announcement ===
Line 228:		Line 234:

	=== Community Reactions Following Announcement ===		=== Community Reactions Following Announcement ===
	The Reddit community was largely supportive of the situation and the level of transparency provided was praised<ref name=":0" ~~/><ref~~>[https://old.reddit.com/r/BitcoinCA/comments/6esvv5/quadrigacx_did_you_just_lose_17_million_cad/didht9d/ Sebastian Livermore - "I really hope you guys recover from this. ~~Hopefully maybe ETH will go back to $50ETH/USD~~ and ~~you'll be able to buy back all the trapped ETH~~." - Reddit] (Apr 5, 2023)</ref>.<blockquote>thank you for the statement and transparency and sharing all details.</blockquote><blockquote>I really hope you guys recover from this. Hopefully maybe ETH will go back to $50ETH/USD and you'll be able to buy back all the trapped ETH.</blockquote>		While many in the community had concerns about the lost funds, there was generally an attitude of support for the platform: The Reddit community was largely supportive of the situation and the level of transparency provided was praised<ref name=":6">[https://old.reddit.com/r/BitcoinCA/comments/6esvv5/quadrigacx_did_you_just_lose_17_million_cad/didht9d/ Sebastian Livermore - "I really hope you guys recover from this... You being the only exchange in Canada and going under is not a good thing." - Reddit] (Apr 5, 2023)</ref><ref name=":0" /><ref>[https://old.reddit.com/r/BitcoinCA/comments/6esvv5/quadrigacx_did_you_just_lose_17_million_cad/didnopa/ Primander - "QuadrigaCX has always worked well for me. I hope that they can recover from this." - Reddit] (May 8, 2023)</ref>.<blockquote>thank you for the statement and transparency and sharing all details.</blockquote><blockquote>I really hope you guys recover from this. Hopefully maybe ETH will go back to $50ETH/USD and you'll be able to buy back all the trapped ETH. You being the only exchange in Canada and going under is not a good thing.</blockquote><blockquote>QuadrigaCX has always worked well for me. I hope that they can recover from this.</blockquote>

	== Ultimate Outcome ==		== Ultimate Outcome ==
Line 234:		Line 240:

	What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?		What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

			=== Users Reported Successful Withdrawals ===
			Users started reporting successful withdrawals<ref name=":7" />

			=== Some Users Remove Funds From Platform As A Precaution ===
			A few users announced they were removing funds from the platform as a result of the incident, and others recommended to do so.<blockquote></blockquote>

	== Total Amount Recovered ==		== Total Amount Recovered ==

Azoundria: starting

2023-05-08T17:55:23Z

starting

← Older revision		Revision as of 11:55, 8 May 2023
Line 4:		Line 4:

	== About QuadrigaCX ==		== About QuadrigaCX ==



Line 57:		Line 58:

	=== Regular SEDAR Released Documents ===		=== Regular SEDAR Released Documents ===
	QuadrigaCX regularly released documents through SEDAR (the System for Electronic Document Analysis and Retrieval), a system overseen by the Canadian Securities Administrators<ref>[https://sedar.com/homepage_en.htm SEDAR Homepage] (May 5, 2023)</ref>. In documents released on SEDAR, QuadrigaCX described itself as a leader in the digital currency space, providing innovative products and services such as Canada's longest-running Bitcoin trading platform, merchant payment processing platform, and the country's first R&D lab for Blockchain technology. The company is regulated by FINTRAC as a Money Services Business and is driving innovation in the rapidly-expanding Blockchain and digital currency services sector<ref name=":3" />.<blockquote>Quadriga FinTech Solutions Corp. is a leading pioneer in the digital currency space. The company		QuadrigaCX regularly released documents through SEDAR (the System for Electronic Document Analysis and Retrieval), a system overseen by the Canadian Securities Administrators<ref>[https://sedar.com/homepage_en.htm SEDAR Homepage] (May 5, 2023)</ref>. In documents released on SEDAR, QuadrigaCX described itself as a leader in the digital currency space, providing innovative products and services such as Canada's longest-running Bitcoin trading platform, merchant payment processing platform, and the country's first R&D lab for Blockchain technology. The company is regulated by FINTRAC as a Money Services Business and is driving innovation in the rapidly-expanding Blockchain and digital currency services sector<ref name=":3" /><ref name=":5" />.<blockquote>Quadriga FinTech Solutions Corp. is a leading pioneer in the digital currency space. The company

	provides a wide range of innovative products and services, including Canada’s longest-running Bitcoin		provides a wide range of innovative products and services, including Canada’s longest-running Bitcoin
Line 72:		Line 73:

	== The Reality ==		== The Reality ==
	While QuadrigaCX was still Canada's leading cryptocurrency exchange platform at this time, there were many cracks and warning signs ~~available~~.		While QuadrigaCX was still Canada's leading cryptocurrency exchange platform at this time, there were many cracks and warning signs which started to develop prior to the smart contract loss and ultimate collapse of the platform.

	=== Directors Anthony Milewski and Lovie Horner Resignations ===		=== Directors Anthony Milewski and Lovie Horner Resignations ===
Line 98:		Line 99:

	2. the Executive Director revokes this order as it applies to the Reporting Issuer. </blockquote>		2. the Executive Director revokes this order as it applies to the Reporting Issuer. </blockquote>

			=== Director Bill Filtness and CFO Natasha Tsai Resignations ===
			On March 18th, 2016, Quadriga FinTech Solutions Corp. announced that one more of its directors, Bill Filtness, and CFO Natasha Tsai, had resigned from their positions. The company stated it was currently searching for new directors to fill the vacancies<ref name=":5" />.<blockquote>TORONTO – (March 18, 2016) Quadriga FinTech Solutions Corp. (the “Company”) announces that as Bill Filtness and Natasha Tsai have resigned as Director and Chief Financial Officer of the Company. The board of directors is currently conducting a search to fill the vacant roles and would like to thank both Mr. Filtness and Ms. Tsai for their efforts and contributions to the Company.</blockquote>


	This sections is included if a case involved deception or information that was unknown at the time. Examples include:		This sections is included if a case involved deception or information that was unknown at the time. Examples include:

	* When the service was actually started (if different than the "official story").		* When the service was actually started (if different than the "official story").
	* Who actually ran a service and their own personal history.		* Who actually ran a service and their own personal history.
Line 161:		Line 164:
	\|-		\|-
	\|March 18th, 2016		\|March 18th, 2016
	\|~~More Resignations~~		\|Bill Filtness and Natasha Tsai Resign
	\|Director Bill Filtness and CFO Natasha Tsai both resign~~. This leaves Gerald Cotten as the sole executive~~<ref name="~~verdict-2372~~" ~~/>.<ref~~>[https://www.investorx.ca/pdf/1603180956362377/(quadriga-fintech-solutions-corp)(news-release-english)(03-18-2016)?mobile=false Quadriga Announces Resignation of Director and Officer - InvestorX] (May 5, 2023)</ref> ~~TBD review more information from PDF~~.		\|Director Bill Filtness and CFO Natasha Tsai both resign<ref name=":5">[https://www.investorx.ca/pdf/1603180956362377/(quadriga-fintech-solutions-corp)(news-release-english)(03-18-2016)?mobile=false Quadriga Announces Resignation of Director and Officer - InvestorX] (May 5, 2023)</ref>. This leaves Gerald Cotten as the sole executive<ref name="verdict-2372" />.
	\|-		\|-
	\|May 30th, 2017 3:15:18 AM MDT		\|May 30th, 2017 3:15:18 AM MDT
Line 174:		Line 177:
	\|June 2nd, 2017 5:36:48 AM MDT		\|June 2nd, 2017 5:36:48 AM MDT
	\|Details Posted on Reddit		\|Details Posted on Reddit
	\|The QuadrigaCX platform posts details about the incident to Reddit<ref name="reddit-233" />. ~~(TBD expand with details.)~~		\|The QuadrigaCX platform posts details about the incident to Reddit. They report an issue with their sweeping process for incoming Ether, causing a significant amount of Ether to be trapped in a splitter contract due to a failed transfer to the hot wallet. The problem occurred after upgrading from Geth 1.5.3 to 1.5.9. The issue was related to the prefixing of the Hex string in the Web3 SHA3 implementation. The contract was called with an invalid data payload, resulting in the trapped ETH. The problem has been resolved, and recoverability could be addressed through an amendment to EIP 156. While this setback has impacted QuadrigaCX's profits, it does not affect account funding, withdrawals, or the exchange's day-to-day operations. All withdrawals, including Ether, are being processed normally, and client balances remain unaffected<ref name="reddit-233" />.
	\|-		\|-
	\|June 2nd, 2017 6:20:35 AM MDT		\|June 2nd, 2017 6:20:35 AM MDT
Line 182:		Line 185:
	\|June 2nd, 2017 12:00:01 PM MDT		\|June 2nd, 2017 12:00:01 PM MDT
	\|CoinDesk Article		\|CoinDesk Article
	\|CoinDesk publishes an article on the incident<ref name="coindesk-234" />. ~~(TBD expand with details.)~~		\|CoinDesk publishes an article on the incident. They report a loss of up to $14 million worth of ether due to an issue with a splitter contract used to separate incoming ethers. The problem arose after an upgrade to the ethereum client software, which caused the contract to fail in executing the transfer to the hot wallet for several days in May. As a result, a significant amount of ether became trapped in the contract. The issue has been resolved, but it has impacted the exchange's profits. QuadrigaCX emphasized that the incident did not affect its solvency or operations, and all withdrawals, including ether, are being processed normally without affecting client balances. Representatives from QuadrigaCX have not provided further comments at the moment<ref name="coindesk-234" />.
	\|-		\|-
	\|June 2nd, 2017		\|June 2nd, 2017

Azoundria: 30 more minutes.

2023-05-05T19:19:12Z

30 more minutes.

← Older revision		Revision as of 13:19, 5 May 2023
Line 26:		Line 26:

	=== Early Interview With Gerald Cotten ===		=== Early Interview With Gerald Cotten ===
	An early interview ~~with Gerald Cotten published~~ by The Georgia Straight<ref name=":1">[https://www.straight.com/life/587456/geek-speak-gerald-cotton-ceo-quadriga-cx Geek Speak: Gerald Cotten, CEO of Quadriga CX - The Georgia Straight] (Apr 27, 2023)</ref>.<blockquote>'''How would you explain, very briefly, Bitcoin to a newbie?'''		In an early interview by The Georgia Straight, QuadrigaCX CEO Gerald Cotten discussed various aspects of the cryptocurrency industry. He describes Bitcoin as a decentralized, peer-to-peer payment system that allows users to send payments without the need for a central authority. The easiest way to get bitcoins in Vancouver is through the company's Bitcoin ATM, which charges no fees and allows for instant funding through Interac Online. The company plans to spread its ATMs across Canada and make buying bitcoins easier for Canadians. The CEO would like to see more clarity from the government on cryptocurrency regulation, and mentions Litecoin and Dogecoin as other cryptocurrencies that have caught his attention. The company is adding Dogecoin to its website in the coming weeks due to its popularity and strong community support<ref name=":1">[https://www.straight.com/life/587456/geek-speak-gerald-cotton-ceo-quadriga-cx Geek Speak: Gerald Cotten, CEO of Quadriga CX - The Georgia Straight] (Apr 27, 2023)</ref>.<blockquote>'''How would you explain, very briefly, Bitcoin to a newbie?'''

	To a newbie, I would describe it as a decentralized, peer-to-peer payment system. It basically allows you to send payments from one user to another without the need of a central authority, such as a bank.		To a newbie, I would describe it as a decentralized, peer-to-peer payment system. It basically allows you to send payments from one user to another without the need of a central authority, such as a bank.
Line 55:		Line 55:

	In addition to that, Dogecoin has been getting a lot of media attention. So, we’re actually adding Dogecoin to our website within the coming weeks. It seems to have a huge amount of community support. It’s very popular on Reddit, and because of that reason it’s caught my attention.</blockquote>		In addition to that, Dogecoin has been getting a lot of media attention. So, we’re actually adding Dogecoin to our website within the coming weeks. It seems to have a huge amount of community support. It’s very popular on Reddit, and because of that reason it’s caught my attention.</blockquote>

			=== Regular SEDAR Released Documents ===
			QuadrigaCX regularly released documents through SEDAR (the System for Electronic Document Analysis and Retrieval), a system overseen by the Canadian Securities Administrators<ref>[https://sedar.com/homepage_en.htm SEDAR Homepage] (May 5, 2023)</ref>. In documents released on SEDAR, QuadrigaCX described itself as a leader in the digital currency space, providing innovative products and services such as Canada's longest-running Bitcoin trading platform, merchant payment processing platform, and the country's first R&D lab for Blockchain technology. The company is regulated by FINTRAC as a Money Services Business and is driving innovation in the rapidly-expanding Blockchain and digital currency services sector<ref name=":3" />.<blockquote>Quadriga FinTech Solutions Corp. is a leading pioneer in the digital currency space. The company

			provides a wide range of innovative products and services, including Canada’s longest-running Bitcoin

			trading platform, merchant payment processing platform and Canada’s first R&D lab for Blockchain

			technology. Quadriga is regulated by the Financial Transactions and Reports Analysis Centre of Canada

			(FINTRAC) as a Money Services Business. FINTRAC is the main supervisory body that oversees and

			regulates Canada’s financial services industry. With industry-leading security and ease of use, Quadriga

			is driving innovation in the rapidly-expanding Blockchain and digital currency services sector.</blockquote>

	== The Reality ==		== The Reality ==
			While QuadrigaCX was still Canada's leading cryptocurrency exchange platform at this time, there were many cracks and warning signs available.

			=== Directors Anthony Milewski and Lovie Horner Resignations ===
			On February 29, 2016, Quadriga FinTech Solutions Corp. announced that two of its directors, Anthony Milewski and Lovie Horner, had resigned from their positions. The company stated it was currently searching for new directors to fill the vacancies<ref name=":3" />.<blockquote>TORONTO – (February 29, 2016) Quadriga FinTech Solutions Corp. (the “Company”) announces that

			Anthony Milewski and Lovie Horner have resigned as Directors of the Company effective immediately.

			The board of directors is currently conducting a search to fill the vacant roles and would like to thank both

			Mr. Milewski and Ms. Horner for their efforts and contributions to the Company.</blockquote>

			=== British Columbia Securities Commission Cease Trade Order ===
			The British Columbia Securities Commission (BCSC) issued a cease trade order on March 8th, 2016 for several reporting issuers, including Quadriga Fintech Solutions Corp., due to their failure to file annual audited financial statements and management's discussion and analysis for the period ended October 31, 2015. The order prohibited all trading in their securities until the required records were filed and the Executive Director revoked the order. The order was issued by Allan Lim, the Manager Corporate Finance at BCSC<ref name=":4">[https://cto-iov.csa-acvm.ca/ArticleFile.asp?Instance=101&ID=410FB770B2F1486A88CB66C583DAC46B Cease Trade Order - BCSC] (May 5, 2023)</ref>.<blockquote>The Reporting Issuer has not filed:

			1. annual audited financial statements for the year ended October 31, 2015, as required under Part 4 of National Instrument 51-102 Continuous Disclosure Obligations (NI 51-102), and

			2. a Form 51-102F1 Management's Discussion and Analysis for the period ended October 31, 2015, as required under Part 5 of NI 51-102

			(the required records).


			Under section 164(1) of the Act, the Executive Director orders that all trading in the securities of the Reporting Issuer cease until:

			1. it files the required records, completed in accordance with the Act and rules, and

			2. the Executive Director revokes this order as it applies to the Reporting Issuer. </blockquote>


	This sections is included if a case involved deception or information that was unknown at the time. Examples include:		This sections is included if a case involved deception or information that was unknown at the time. Examples include:

Line 107:		Line 150:
	\|March 15th, 2015 7:59:33 PM MDT		\|March 15th, 2015 7:59:33 PM MDT
	\|Quadriga Fintech Solutions Corporate Profile		\|Quadriga Fintech Solutions Corporate Profile
	\|~~A capture of the~~ corporate profile of Quadriga Fintech Solutions. It highlights the online trading platform, the "first bitcoin exchange in Canada to be licensed by FinTRAC". According to this description, the exchange also supported "gold bullion", Quadriga is offering merchant payment processing systems for businesses to accept bitcoin, and they are in negotiations with two online casinos to become their "sole bitcoin processing merchant platform". Finally, Quadriga utilizes "the technologyy of the bitcoin blockchain" to provide a remittance service for Mexico and the Carribbean<ref name=":2" />.		\|The corporate profile of Quadriga Fintech Solutions is captured. It highlights the online trading platform, the "first bitcoin exchange in Canada to be licensed by FinTRAC". According to this description, the exchange also supported "gold bullion", Quadriga is offering merchant payment processing systems for businesses to accept bitcoin, and they are in negotiations with two online casinos to become their "sole bitcoin processing merchant platform". Finally, Quadriga utilizes "the technologyy of the bitcoin blockchain" to provide a remittance service for Mexico and the Carribbean<ref name=":2" />.
	\|-		\|-
	\|February 29th, 2016		\|February 29th, 2016
	\|~~Director Resignations~~		\|Anthony Milewski and Lovie Horner Resign
	\|Anthony Milewski and Lovie Horner resign<ref name="verdict-2372" />. <ref>[https://www.sedar.com/GetFile.do?lang=EN&docClass=8&issuerNo=00037030&issuerType=03&projectNo=02448663&docId=3870610 Quadriga Announces Resignation of Directors - SEDAR Filing] (Apr 28, 2023)</ref>~~(TBD follow links.)~~		\|Anthony Milewski and Lovie Horner resign<ref name="verdict-2372" />. "The board of directors is currently conducting a search to fill the vacant roles and would like to thank both Mr. Milewski and Ms. Horner for their efforts and contributions to the Company."<ref name=":3">[https://www.sedar.com/GetFile.do?lang=EN&docClass=8&issuerNo=00037030&issuerType=03&projectNo=02448663&docId=3870610 Quadriga Announces Resignation of Directors - SEDAR Filing] (Apr 28, 2023)</ref>
	\|-		\|-
	\|March 8th, 2016		\|March 8th, 2016
	\|BCSC Cease Trade Order		\|BCSC Cease Trade Order
	\|The British Columbia Securities Commission issues a cease trade order, since no audited financial statements were recieved<ref name="verdict-2372" />.		\|The British Columbia Securities Commission issues a cease trade order, since no audited financial statements were recieved<ref name="verdict-2372" />. The order was issued against several reporting issuers, including Quadriga Fintech Solutions Corp., due to their failure to file annual audited financial statements and management's discussion and analysis for the period ended October 31, 2015. The order prohibited all trading in their securities until the required records were filed and the Executive Director revoked the order<ref name=":4" />.
	\|-		\|-
	\|March 18th, 2016		\|March 18th, 2016
	\|More Resignations		\|More Resignations
	\|Director Bill Filtness and CFO Natasha Tsai both resign. This leaves Gerald Cotten as the sole executive<ref name="verdict-2372" />.		\|Director Bill Filtness and CFO Natasha Tsai both resign. This leaves Gerald Cotten as the sole executive<ref name="verdict-2372" />.<ref>[https://www.investorx.ca/pdf/1603180956362377/(quadriga-fintech-solutions-corp)(news-release-english)(03-18-2016)?mobile=false Quadriga Announces Resignation of Director and Officer - InvestorX] (May 5, 2023)</ref> TBD review more information from PDF.
	\|-		\|-
	\|May 30th, 2017 3:15:18 AM MDT		\|May 30th, 2017 3:15:18 AM MDT

Azoundria: Another 30 minutes updating timeline.

2023-04-28T17:07:16Z

Another 30 minutes updating timeline.

Show changes

Azoundria: Initial case study created and online now.

2023-04-05T19:57:32Z

Initial case study created and online now.

Show changes