2/12/2020 - Resource Spawning Exploit

[Alex]

Hi everyone,

Not so bad news given the title. For the sake of full transparency and communication, I am publicly announcing that I caught and fixed a resource spawning exploit today. All illicitly generated resources were removed, the perpetrators have been banned, and the bug has been fixed.

How the Exploit Worked:

By setting your tax bracket rate for resources over 100%, it was possible to create extra resources through regular taxation. There was a check in the code for this, both on the user-end and server-end, but there was a bug in the server-end (a typo in variable name) that caused the server-end restrictions to fail. I'm sure the user-end restrictions prevented anyone from actually going through the extra effort to try this until just a couple of days ago.

Who Used the Exploit

"Nation" of "Nationia" (ID 189749) used the exploit to generate 5,022,002 Uranium, 10,152,000 Gasoline, 8,100,000 Munitions, 9,124,000 Steel, and 8,884,200 Aluminum. These resources were transferred to a variety of "offshore" alliance banks, and another nation (ID 95654) helped manage/transfer funds. It's unclear if these two nations were controlled by the same user.

ID 189749 clearly existed for the sole purpose of using this exploit, and went into Vacation Mode after spawning the resources.

Screenshots of their nation pages

These two nations have now been permanently banned from Politics & War.

Discovering the Exploit

This exploit was reported to me by @Dryad on Discord. He reported a suspicious deposit to their alliance bank, and I took a look. After investigation, I saw that the resources were generated from strange taxation records (4800000% resource tax rate) and identified the rest from there.

They also asked me to thank @Vein and @neantasia as well (I think they discussed the issue among themselves before Dryad ultimately contacted me.)

They're receiving a special achievement in-game for their help, as well as the player Borg who also helped debug this issue and some other site vulnerabilities recently.

Fixing the Exploit

Checking into the source code, I saw that this was just a typo in a variable name, and never should have existed in the first place. I quickly corrected that and tested to ensure things are now working properly. I also instituted a fail-safe check on the actual revenue generation script that runs every turn to restrict all tax rates to be between 0-100%. These two changes will ensure that this never happens again.

---

I know that it is concerning to learn about such vulnerabilities in the game, but I believe that you all (the players) are better served when I am open and transparent about such occurrences, rather than trying to sweep them under the rug. I am certainly not perfect and mistakes happen, but fortunately in this instance this was identified and fixed almost immediately, and no damage or unfair advantage was gained thanks to the quick and honest action of the players noted above. Together, we can continue to develop and improve Politics & War to create a better game and community for everyone.

 

EDIT: To be clear, I am confident that this is the extent of the abuse of this bug. All resource generating transactions are clearly marked in the taxation records, so it was easy to pull a list of every instance this happened.

[Ragnarok8085]

Good on you mate

[Emperor Adam]

Good work Alex. Good find, Dryad and crew.

[Changeup]

I'm honestly shocked we've gone this long without a temper tantrum over an NPO gov member getting banned for cheating.

[Broke]

yay, one cheater down

stares at some individuals

50000 more to go (oh right and what manga are they gonna use this time?)

[Blackbird]

6 minutes ago, Broke said:

blahblahblah

 

Alex, bring back down vote  

[Ryleh]

@Alex

Over what period of time did this occur? The exploit.

[Havgle]

Everyone congratulates Alex for his work. Large plot unfolds that important alliance does bad on a much worse level, everyone is triggered

[Alex]

2 minutes ago, Ryleh said:

@Alex

Over what period of time did this occur? The exploit.

Good question! Sorry I failed to answer that in the OP.

This just happened today (February 12, turns 02:00, 06:00, and 08:00). There were only 3 turns where they used this bug to generate resources, and it was easy enough to sum it all up and remove it from the game.

From the time when it first occurred, to my announcement here, was about 17 hours.

[Charnel Harper]

w/e

[Filmore]

[GoomyMan]

Nice catch Alex! Impressive how quickly you found them out =]

[Kaz]

I think I’m going to buy more credits.  This is worth supporting.    This is the type of proactive moderation of the game we’ve all been asking for.  

[Theodosius]

1 hour ago, Alex said:

NPO cheating again

[Necrosin]

so let me get this strait....some guy sees a "suspicious bank deposit" what in the hell does that look like? what defines suspicious in this game? we have alliances moving billions in goods constantly playing the great shell game. so in the middle of all that someone sees something odd and forms a group and reports it.
now....taking that you find a exploit, that either didnt exist before today or has been there unseen by you, that explains how someone made all this in 3 turns? a 33 day old nation in a Goons protectorate finds a possible Day0 vulnerability after 5 years and then happens to send it to all to Pacificas bankers? really?

THIS IS A JOKE!!!

this is the most bold faced abuse of power i have ever seen in a game. after all the fake reports and the attrition against our allies you people still cant stomp out Pacifica and so you form this obvious hatchet job as a pretense to delete our bank. and you wonder why people continue to write bad reviews about your work. perhaps it is because you are acting like this is a high school popularity contest mr "God of Upvotes" instead of a business. well enjoy the fruits of your hard work with your friends. you certainly have earned it

[Zygon]

Just now, Necrosin said:

so let me get this strait....some guy sees a "suspicious bank deposit" what in the hell does that look like? what defines suspicious in this game? we have alliances moving billions in goods constantly playing the great shell game. so in the middle of all that someone sees something odd and forms a group and reports it.
now....taking that you find a exploit, that either didnt exist before today or has been there unseen by you, that explains how someone made all this in 3 turns? a 33 day old nation in a Goons protectorate finds a possible Day0 vulnerability after 5 years and then happens to send it to all to Pacificas bankers? really?

THIS IS A JOKE!!!

this is the most bold faced abuse of power i have ever seen in a game. after all the fake reports and the attrition against our allies you people still cant stomp out Pacifica and so you form this obvious hatchet job as a pretense to delete our bank. and you wonder why people continue to write bad reviews about your work. perhaps it is because you are acting like this is a high school popularity contest mr "God of Upvotes" instead of a business. well enjoy the fruits of your hard work with your friends. you certainly have earned it

[Shiho Nishizumi]

Just now, Necrosin said:

so let me get this strait....some guy sees a "suspicious bank deposit" what in the hell does that look like? what defines suspicious in this game? we have alliances moving billions in goods constantly playing the great shell game. so in the middle of all that someone sees something odd and forms a group and reports it.
now....taking that you find a exploit, that either didnt exist before today or has been there unseen by you, that explains how someone made all this in 3 turns? a 33 day old nation in a Goons protectorate finds a possible Day0 vulnerability after 5 years and then happens to send it to all to Pacificas bankers? really?

THIS IS A JOKE!!!

this is the most bold faced abuse of power i have ever seen in a game. after all the fake reports and the attrition against our allies you people still cant stomp out Pacifica and so you form this obvious hatchet job as a pretense to delete our bank. and you wonder why people continue to write bad reviews about your work. perhaps it is because you are acting like this is a high school popularity contest mr "God of Upvotes" instead of a business. well enjoy the fruits of your hard work with your friends. you certainly have earned it

 

[Necrosin]

you think this is salty or hate? really? this is a simple fact. and i feel sorry for you because you cant see it

[Filmore]

6 minutes ago, Necrosin said:

so let me get this strait....some guy sees a "suspicious bank deposit" what in the hell does that look like? what defines suspicious in this game? we have alliances moving billions in goods constantly playing the great shell game. so in the middle of all that someone sees something odd and forms a group and reports it.
now....taking that you find a exploit, that either didnt exist before today or has been there unseen by you, that explains how someone made all this in 3 turns? a 33 day old nation in a Goons protectorate finds a possible Day0 vulnerability after 5 years and then happens to send it to all to Pacificas bankers? really?

THIS IS A JOKE!!!

this is the most bold faced abuse of power i have ever seen in a game. after all the fake reports and the attrition against our allies you people still cant stomp out Pacifica and so you form this obvious hatchet job as a pretense to delete our bank. and you wonder why people continue to write bad reviews about your work. perhaps it is because you are acting like this is a high school popularity contest mr "God of Upvotes" instead of a business. well enjoy the fruits of your hard work with your friends. you certainly have earned it

Ok Boomer

[Emperor Adam]

2 minutes ago, Necrosin said:

you think this is salty or hate? really? this is a simple fact. and i feel sorry for you because you cant see it

He literally has proof that the system was broken and these nations were abusing it. You're both ridiculous and moronic. 

[Broke]

6 minutes ago, Necrosin said:

so let me get this strait....some guy sees a "suspicious bank deposit" what in the hell does that look like? what defines suspicious in this game? we have alliances moving billions in goods constantly playing the great shell game. so in the middle of all that someone sees something odd and forms a group and reports it.
now....taking that you find a exploit, that either didnt exist before today or has been there unseen by you, that explains how someone made all this in 3 turns? a 33 day old nation in a Goons protectorate finds a possible Day0 vulnerability after 5 years and then happens to send it to all to Pacificas bankers? really?

THIS IS A JOKE!!!

this is the most bold faced abuse of power i have ever seen in a game. after all the fake reports and the attrition against our allies you people still cant stomp out Pacifica and so you form this obvious hatchet job as a pretense to delete our bank. and you wonder why people continue to write bad reviews about your work. perhaps it is because you are acting like this is a high school popularity contest mr "God of Upvotes" instead of a business. well enjoy the fruits of your hard work with your friends. you certainly have earned it

strait

thonk

[Zygon]

3 minutes ago, Necrosin said:

you think this is salty or hate? really? this is a simple fact. and i feel sorry for you because you cant see it

[Fulcrum]

Considering it was only three turns, is there a possibility the user decided to try it out, check back in a day, and report it? But then again you did say the money was transferred and the nation put in VM, so I guess not.

[Thalmor]

Just now, Necrosin said:

you think this is salty or hate? really? this is a simple fact. and i feel sorry for you because you cant see it

Just delete your nation then. Your emotional investment right now is so high that you're flaming mad over nations being banned for spawning in millions of resources through an exploit. This action in particular is so black-and-white that it's obvious you're just being super irrational. It's also not good for your personal mental and emotional health to keep putting yourself through this abuse and you need to talk a break. 

[Shiho Nishizumi]

Just now, Thalmor said:

Just delete your nation then. Your emotional investment right now is so high that you're flaming mad over nations being banned for spawning in millions of resources through an exploit. This action in particular is so black-and-white that it's obvious you're just being super irrational. It's also not good for your personal mental and emotional health to keep putting yourself through this abuse and you need to talk a break. 

Well, he already deleted.