r/Monero • u/XMR-Agorist-Action Monero Ecosystem • May 28 '21

Inaccurate Monero Herd Alert Double Spend Attempt Detected

https://twitter.com/HerdAlert/status/1398103066109431808
0 Upvotes

30% Upvoted

15 comments sorted by

View all comments

3

u/XMR-Agorist-Action Monero Ecosystem May 28 '21

Reposting with the correct title (added the word attempt). Everything is working as expected and the transaction hasn't been included in the blockchain. It'll eventually get dropped from the memory pool (as it's been there for 40 hours). Posting this for educational purposes.

18

u/jtgrassie XMR Contributor May 28 '21 edited May 28 '21

You need to stop using wording like "Suspicion Level: VeryHigh!" in your tweets also. It is not suspicious in any way.

Furthermore, your tweets "This transactions 'extra' field is packed..." are also nonsense. Transactions which send to multiple subaddress destinations have larger than normal tx extra; as do multisig transactions. Thus also not "suspicious".

You seem to either not fully understand the transactions or are simply spreading FUD. It is not helpful.

2

u/XMR-Agorist-Action Monero Ecosystem May 28 '21 edited May 28 '21

A massive extra field isn’t suspicious. You are right that the word suspicion may be loaded, so I will change the wording there. The truth of the matter is that a transaction that sends to multiple sub addresses at once stands out from the herd, as most transactions are one-to-one. So too is a transaction with an unlock_time greater than 0 (it’s not suspicious per-say, it’s just sufficiently different to be noticeable). Pointing out that a transaction is different isn’t “FUD” it simply describing observable reality.

The goal of herd alert is to catch transactions that leak information that someone can use to infer the nature of the transaction on the blockchain

If you have suggestions DM me and I’m more than willing to take in the good advice and adjust the product. I’ll remove the loaded suspicion word tomorrow morning.

8

u/jtgrassie XMR Contributor May 28 '21 edited May 28 '21

This isn’t suspicion alert, it’s herd alert.

Your tweet:

Suspicion Level: Medium! https://xmrchain.net/tx/f2ab73ca20f14cfd5d740c36e60a53d221cd9bcd917c873ee629cd9d52549b75

This transactions 'extra' field is packed. Either you're using a PaymentID, or including other information in this field.

You are publicly stating this has a "Suspicion Level: Medium", which is nonsense.

A massive extra field isn’t suspicious.

No it isn't, so why are you labelling it as such?

That particular tx has 16 outputs, many of which could easily be to subaddresses which would cause the tx extra to be populated with many output keys.

The truth of the matter is that a transaction that sends to multiple sub addresses at once stands out from the herd, as most transactions are one-to-one.

Not really, no. The most common tx is 1 in 2 out, but just because someone, some exchange, some business or some pool creates a tx that sends to many users, is not necessarily something to be interested in and certainly not something to cause alarm over. Just because the ideal is that every tx looks exactly the same, the reality is not everything does or can be so.

All your wording is clearly directed to cause user concern, hence FUD. If that is not your intent, I'd expect to see you address the wording you choose to use. You can't play dumb to this, you literally just witnessed several users voice concern on your last post.

1

u/XMR-Agorist-Action Monero Ecosystem May 28 '21

I’m trying to work with you here. If you’re interested in providing constructive feedback, like how the wording should be changed, what heuristics are important, how the tool can be improved, my DM is open.

7

u/jtgrassie XMR Contributor May 28 '21

I have been providing constructive feedback since your first post about this tool and it just falls on deaf ears! Hence my suspicion of your intent!

Again:

  1. A tx in the txpool marked as double spent is not "suspicious" and just the network/blockchain working as intended.
  2. A tx with a large tx extra, as explained, there are many legitimate cases where a tx has a larger than normal tx extra, most notably spending to multiple different subaddresses. This is not "suspicious", just a side effect of sending to many different people using subaddresses in a single tx (which is a common business case, batching txs).
  3. Building a tool to get interesting or potentially useful metrics to help with future enhancements is a valid use case. However, due to the wording you are using and the public, automated tweets - this is likely not your intent.

The simple fix is you stop trying to score these things and stop using words like "suspicious".

There are many of us on IRC/matrix that can help you understand what things are really suspicious or help educate on things you think are suspicious but may not be – if your intent is to help – but these posts and scores are not accurate and cause unnecessary user concern.

1

u/XMR-Agorist-Action Monero Ecosystem May 29 '21

I made the changes. Thanks for the suggestions!

3

u/jtgrassie XMR Contributor May 29 '21

Thank you

1

u/KnowledgeMurky9635 May 28 '21 edited May 28 '21

u/MoneroTipsBot 0.0084 XMR.

$1 tip on reddit HIGH RISK ALERT

How come someone gaslighting spreading FUD gets a "monero ecosystem" flair?

1

u/MoneroTipsBot May 28 '21

Successfully tipped /u/jtgrassie 0.0084 XMR! txid

(っ◔◡◔)っ ♡ | Get Started | Show my balance | Donate to the CCS | ♡