[nly]

Bitcoin is decentralised, so, from Neweggs perspective, the transaction is never completed 'online'. Their payment processor (I'm guessing it's going to be Bitpay) has to wait until they see your transaction on the Bitcoin network before they tell Newegg that it's paid. Think of it as waiting for a cheque to arrive. A timeout is just sensible so you're not reserving stock.

[beaner]

That's not what the timer is referring to. The 15 minute timer is in place due to the exchange rate. Newegg prices their items in dollars, BitPay converts it to a BTC price and presents that price to the user. They can't show that same BTC price forever, becasue if the price of bitcoin drops by 50% over 24 hours, and you decide to leave your window open and order then instead of now, you will get whatever you are buying for half the price. Bitpay guaranteed the USD price that was set on the item to the merchant. Now they owe it, but have only collected half. Thus Bitpay would be out hundreds of dollars (or whatever half your order is). Similarly, if the price rose by 100% over 24 hours you could accidentally pay double. So they put a timer on it.

[logicallee]

If it's a moving spot price that lasts just 15 minutes, is the exchange market deep enough to keep people from abusing this?

By placing a huge number of buy orders at a time when the market is quite shallow, all within a few minutes (temporarily driving the exchange price up sharply) the BTC-denominated price of goods on Newegg can become very low in a 15-minute windows.

Huge numbers of orders ($millions) could then be placed at that low BTC price, included by a distributed group of people.

What protects against this? Moving the price for 15 minutes seems quite plausible but I don't know the details - and am not an expert.

[DSMan195276]

Honestly, the price of the BTC is decently stable, I wouldn't expect anything to happen which would effect their prices enough to make a difference within a 15-minute window.

Ex. The Bitcoin is on an uptrend and went up 30$ in the window between when I checked it ~8 hours ago and just now. Even if it managed to do that in a 15-minute window of time, that's only 30-dollars off of every 600 dollars you spend. A 100$ dollar order will only see a 5 dollar 'discount'. And if it goes the other way, they make a bit more, so over time I'm guessing it'll mostly even out, Maybe a bit more in the consumers favor if we assume the BTC price will end-up going up.

[logicallee]

I mean, e.g. buying $800K worth of bitcoin in 15 minutes, so that you can increase the price and then buy $5M worth of goods NewEgg - would $800K in fifteen minutes press newegg's btc-denominated price well below wholesale on those same electronic goods?

[sp332]

The lower graph here shows the depth of the market. Right now, for $800k USD, you can move the price from $656/BTC to $665/BTC. So you might get a $67,700 discount on your $5,000,000 order.

Edit: spaced the link https://bitcoinity.org/markets

[logicallee]

This is good, let's analyze a bit more. It sounds like you know what you're doing. (I don't.)

1. Note you get bitcoins during your manipulation as well - so how much did you overpay for the bitcoins that it took to get you the $67K discount? I count that you achieved a 1.37% rise in price, so even if you put in your full $800K at the higher price, that cost you $10,960 in overpayment. There is a direct relationship between the amount of move that you cause, and the amount that you overpay. So the question is, what that relationship is - we have to compare it with the profits from the NewEgg orders at the manipulated price.

1b. Also note that there is a chance you can sell some of them back at a slightly increased price if NewEgg confirms your order quickly, as you've just filled all the lower-price bids on the exchange you just manipulated.

If nobody knows about your manipulation directly, you might even cause a bull run where people think the price is just going to go up and up - you only meant to manipulate it to a brief target price, not caring about the price fall after, but maybe you can sell at a profit as a follow-on effect.

2. On the other hand, $67,700 discount on $5M order is nothing – it doesn’t cause the price to fall below wholesale, so there’s no reason to do the manipulation, since NewEgg isn’t offering cash, it’s offering product. The question then becomes: how much would we have to increase „1a” (the $10K ”fee” you paid for a 1.37% drop) by, to cause an, e.g., 15% drop, 20% drop, 25% drop, 30% drop, 35% drop, 50% drop, 75% drop, 80% drop, 95% drop. That would be interesting in table form. The drop would have to be high, as the manipulator would have to get product below wholesale price.

3. $5M is not an upper limit. In a distributed way, there’s no way many customers couldn’t place $10M in orders together. However, they would to coordinate and play ball with each other: if any of them knows that manipulation will happen trying to corner a shallow exchange market, they can take the other side of the transaction. If they know that at a certain time, $15M will be spent on manipulating the spot price for 15 minutes, they can just set aside $15M to place on asks on the other side. So it’s quite dangerous, especially if the price movement is intended to be high. The element of surprise would have to be high.

This seems mostly a theoretical exercise, as in practice NewEgg could fail to honor prices that are outside the previous day’s intraday, or that sort of thing.

Still, I'm curious how the numbers would work.

[wmf]

IIRC someone implemented this attack (buying or selling small amounts could move the price on BitStamp and Coinbase would offer to buy/sell large amounts at that price), notified Coinbase, and now it's fixed.

[logicallee]

Interesting :) Do you know what the fix was?

[jafaku]

I think they were using the "last price" instead of the "weighted average", or some stupid mistake like that, and obviously without any sanity checks. Meaning someone could manipulate Coinbase's price by placing a tiny buy order for a very high price or a tiny sell order for a very low price.

[vidarh]

What protects against this is that if you put in a bunch of buy orders for BTC at high dollar amounts, a rash of people would rush to sell their BTC.

You might temporarily drive up the exchange price sharply, but at the cost of buy a ton of BTC at an inflated price.

[logicallee]

Of course, that's the cost. But how much do you have to spend in bitcoins to drive the price up that much?

e.g. buying $800K worth of bitcoin in 15 minutes, so that you can increase the price of BTC and then buy $5M worth of goods NewEgg - would $800K in fifteen minutes press newegg's btc-denominated price well below wholesale on those same electronic goods? (including to cover what you overpaid for the btc to execute your position.)