search

AuroraLS3 / Genie

Genie Bukkit Plugin: https://www.spigotmc.org/resources/genie.43260/
GNU General Public License v3.0
0 stars 1 forks source link

Exploit: Using a macro can get you 40-100 free wishes #22

Open s1h4d0w opened 3 years ago

s1h4d0w commented 3 years ago

I've had to remove the plugin from my server because some players found out that if you use a macro to spam a wish to chat you can go far beyond the wishes your genie has. Apparently the plugin has no proper check to see if a lamp runs out if you spam wishes quick enough.

Players just spam the chat with 10-100x "I want a \<item>" within a second and the plugin actually grants the wish that many times, even though their lamp only has 3 wishes.

Proof, from the "lamps.yml": image image

AuroraLS3 commented 3 years ago

Interesting. Seems like they managed to bypass the if block since each chat event runs on its own thread and is independent of each other..

s1h4d0w commented 3 years ago

Any idea if there's an easy fix for that? Maybe queuing wishes and running them one by one instead of immediately after the chat message event?

AuroraLS3 commented 3 years ago

Yeah it's essentially a concurrency issue so either moving them to a single thread or adding a resource control (like a semaphore/locking) should sort it out.