-
Notifications
You must be signed in to change notification settings - Fork 59
Can be robbed empty easily DO NOT RUN THIS LIVE #17
Comments
FYI, most bots running with this code (and its forks) have already been robbed |
Although I run a npattern fork, this exploit was valid. [04:09] <+s17> .balance |
Haven't put it to the test myself with dummy users, but am about to play around and see what happens to confirm it for myself. Will post experiences. |
[11:14] <+BtcBob> .balance So endciv had 143.66666668 BOBz, and was able to spend it two more times than he had before the balance checker kicked in and denied him. Yeap, I got two extra tips before it caught on.. from a user who tipped his full balance the first time and two that he didn't have available the other two tips. |
at least the dogecoindark bot went offline before it was robbed. lets think about delaying the rpc send or something. a delay somewhere should do the trick. ill be playing around. |
I have pushed an untested fix. Could someone see if it works correctly? It should lock user's ability to tip/rain until a response from the RPC |
/tipbot/bin/tipbot.js:222 it had a problem with return. |
[61004a4] works for me
|
not sure why, but now the balances arent showing up for users, but the wallet still has all the coins. any ideas? |
Possibly add/edit prefix under rpc in your config. |
@justinvforvendetta, did you solve the problem? I see the bot is active again on #dogecoindark. |
yep. like @upgradeadvice mentioned, i forgot to add the prefix. thanks @unek for gettin on top of this so quickly =] |
Installed a default TipBob yesterday before bed and tried the recent exploits without issue. Tipped my full balance three times in a flurry, and it cashed me out and stopped on queue. [21:41] <+BtcBob> !balance No negative balance. Seems good to go for now. Thz unek |
thanks again @unek |
hey @unek im coming across the strangest problem.. suddenly, for no reason, the bot is ignoring me when i try to rain.. it shows me my balance, and lets other users rain/balance as well.. any ideas? ok it let me tip from one of my other registered names that i have in my group. but my balance is on a name it wont let me tip or rain from, just give me balance. so odd. |
I too have the strangest problem where I am ignored when issuing rain/tip commands, other commands work fine and other users have no problems at all. It is so weird. |
I also had the issue you are explaining... Just ask the Owner of the Bot to restart the bot. It worked for me... |
It seems to be related to when the bot is started. If I rain (with active filter enabled:3600sec) without any users active since bot come alive then bot will ignore my requests until it is reboot. Presumable cause is active tip/rain command went zombie; should have error message and cleanup. |
:(
sucks big time ...
Seems the check for 'enough balance' doesnt happen early enough or well enough.
Users can tip 'all their coins' to another user a couple times before it comes back with 'but you only have -128976319827'
Then they do it back and forth and back until they have -all- the coins from the wallet.
VERY UNSECURE, DONT RUN THIS BOT LIVE!!!! VERY UNSECURE, DONT RUN THIS BOT LIVE!!!! VERY UNSECURE, DONT RUN THIS BOT LIVE!!!! VERY UNSECURE, DONT RUN THIS BOT LIVE!!!! VERY UNSECURE, DONT RUN THIS BOT LIVE!!!! VERY UNSECURE, DONT RUN THIS BOT LIVE!!!! VERY UNSECURE, DONT RUN THIS BOT LIVE!!!! VERY UNSECURE, DONT RUN THIS BOT LIVE!!!! VERY UNSECURE, DONT RUN THIS BOT LIVE!!!!
The text was updated successfully, but these errors were encountered: