Skip to content
This repository was archived by the owner on Dec 4, 2020. It is now read-only.

Resolve BCNM entry exploit #1293

Merged
merged 1 commit into from
Oct 9, 2020
Merged

Resolve BCNM entry exploit #1293

merged 1 commit into from
Oct 9, 2020

Conversation

ibm2431
Copy link
Contributor

@ibm2431 ibm2431 commented Oct 9, 2020

Exact explanation at a later date.

Most servers are already aware of this, and have had a chance to apply this fix. If you're a public server owner who isn't, message zach2good on Discord.

I affirm:

  • that I agree to Project Topaz's Limited Contributor License Agreement, as written on this date
  • that I've tested my code since the last commit in the PR, and will test after any later commits

@zach2good zach2good merged commit 34d455a into project-topaz:release Oct 9, 2020
@zach2good zach2good added the exploit Exploits that are harmful to the game label Oct 15, 2020
@ibm2431
Copy link
Contributor Author

ibm2431 commented Oct 22, 2020

When a player interacts with a Burning Circle, they trigger (or trade to) it. They then select various options to identify which battlefield they want to undertake. This initiates a series of responses between the client and the server in the form of eventUpdates.

When the server "finds" a valid, empty battlefield, it then gives the player - and their party members - the battlefield status with the ID of the battlefield they're about to enter. This status is what allows party members to enter the same battlefield as you.

Unfortunately, the orb used to initiate this process wasn't marked as "used" at this point. It was only marked as used when the client sent the final eventFinish back to the server, saying that the player was done with any animations of entering the battlefield. By preventing this final eventFinish from reaching the server, a player could give their party members the battlefield status without "consuming" the entry item. This would allow their party to enter the BC an infinite number of times on the same orb.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
exploit Exploits that are harmful to the game
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants