I did not find this bug, but I'm reporting it:
See: http://forum.bitcoin.org/index.php?topic=19168.msg240196#msg240196
"If you enter 0,005 as amount to be sent, the client sends 5.00
For the US-only localized guys I must add: 0,005 is, for example, in Germany the natural way to type what in the US would be typed as 0.005 - and this is consistent with all kinds of localizations in the operating system.
So a German user is likely to send a much higher amount than she intended to.
We have the bug confirmed on the 0.3.23-beta client on Windows 7 by Dennis1234 and on the 0.3.23-beta client on Linux self compilation by mself. Since my client is running in testnet currently I did some testing:
0,0005 is parsed as "error in amount" 0,005 is reparsed as 5.00 0,05 produces an "error in amount" 0,5 produces an "error in amount"
Reparsed as 5.00 means the following:
I enter 0,005 and upon "Send" the displayed amount changes into 5.00 and I get an error on insufficient funds (I do not have 5 BTC in my current testnet account). From the normal behaviour of the client I assume that, if I had more than 5.00 i would just lose these 5.00.
DEVELOPER INFORMATION:
The bug is in src/util.cpp:ParseMoney. In particular, on line 375 the function explicitly checks for ',' and interprets it as the American/English (or other?) digit grouping symbol. It checks if there is a digit before the comma, and three digits after it (e.g. One Million Dollars can be written as $1,000,000).
Because of this 0,005 is considered valid, even though it makes no sense even from an a digit grouping perspective. I'd say several patches are in order:
- 0,005 should not be considered valid when interpreted as digit grouping
- ParseMoney should be locale sensitive
- OnButtonSend should display the valid it interpreted (after line 1925, nValue) and ask for confirmation.
3 is necessary because bugs like this are likely to crop up for a long time, and it's just all around a good idea to give the user a second chance to verify their input.