search

TF2Autobot / tf2autobot

tf2autobot: an Improved version from tf2-automatic
https://autobot.tf
MIT License
217 stars 79 forks source link

Dueling Mini-Game Failed Check? #83

Closed lordvague closed 4 years ago

lordvague commented 4 years ago

Somehow a user managed to sneak a Dueling Mini-Game with only one use on it past the check. I don't know how it happened, because I have always had the the check turned on, and I just tested it now and it seems to be working. When I looked at the history of the item, it was previously owned by another sales bot on September 12. I then went back into my trade history and saw that I had traded for 5 of them during this time frame from two different users so I preemptively banned (blocked) them so it doesn't happen from those accounts again. The trade history also shows that the 5 D.M-G. those users traded to me were showing 5 uses as well, but I obviously don't trust that information since I now have one with only 1 use that I only could have acquired from them. Any idea how this is happening?

Other info: User A traded 3 DMG in one trade, then followed by a trade of 1 DMG User B traded 1 DMG

lordvague commented 4 years ago

This may actually be a bug/exploit of the steam trading system. I've found another bot user with the same problem back in March, and the circumstances were nearly identical to mine.

idinium96 commented 4 years ago

I will have a look when I am available. Please provide some screenshots and your log files.

I am pretty sure the bot will check all D.M.G for only 5x uses if you enable it on your config (.env/ecosystem.json) file, except if someone give it as a gift to your bot or it's directly from people with their Steam ID in ADMINS array variable (which mean yourself and others that you choose).

lordvague commented 4 years ago

It was not gifted, I made certain of that by combing my trade history during that time frame. As I said in the prior comment, there were only two users who traded DMG during that time.

Sorry, but I failed to get back to you after I did a little more digging. I spoke the the former trading bot owner who previously owned this item to narrow down who traded it to me. This does appear to be an exploit of the steam trading system. The bot was functioning properly. Apparently someone has figured out how to spoof the number of uses while trading. It makes more sense to me that the steam trading system is at fault for this, because it continues to show the 5 uses for the one that was traded to me in my trading history, and that DMG only has a single use. The trader did have a private backpack to hide behind, so maybe a consideration for a future option would be to disallow trading with those who have private backpacks all together or possibly disallow trading to private backpacks for just dueling mini-game.

In any event, I'm removing DMG from my pricelist and will no longer be trading them.

If this exploit becomes widespread, this will likely kill the market for reselling this one item.

lordvague commented 4 years ago

I'm not certain, but I have an idea of how the exploit is accomplished. I know that when you use DMG in game, you can instantly win against another player if the opponent leaves the server or is disconnected. Maybe someone lines up 4 opponents who he can control, and quickly que up a DMG challenge with each opponent and they leave server one after another in order to rack up duel wins very quickly. This could even be scripted to happen as fast as possible with something simple like macro scripting (autohotkey). It's possible that the steam trading system takes a bit of time to register the use amount change on the item and it's being traded before that has a chance to happen.

lordvague commented 4 years ago

Just a follow up. It looks like the problem is now wide-spread. I now see dozens and dozens of bots that are selling less than 5 uses mini-game. :(

idinium96 commented 4 years ago

Just make sure the bots that you saw selling less than 5 uses DMG are using tf2autobot. If yes then idk why since I don't see the bot that uses tf2autobot that I know have that kind of problem. Example: https://backpack.tf/profiles/76561198814783511 https://backpack.tf/profiles/76561198283132487

lordvague commented 4 years ago

I don't think it's a problem with the bot, since it appeared in the trade history as 5 uses. After I did some more digging I found an old exploit where you can alter the item in one of the game's save files. I didn't test the exploit to see if it's still working. The people doing the exploit seem to have moved on, and the market is restored aside from a few traders with the less than 5 uses still stuck with those items.

idinium96 commented 4 years ago

Then this is out of my control and I can't do anything with it unless you found the solution to this problem.