cataclysmbnteam / Cataclysm-BN

Cataclysm: Bright Nights, A fork/variant of Cataclysm:DDA by CleverRaven.
https://docs.cataclysmbn.org
Other
684 stars 269 forks source link

Infinite eyebot resource exploit #2639

Open RoyalFox2140 opened 1 year ago

RoyalFox2140 commented 1 year ago

Describe the bug

Smashing alarm furniture (Vending machines, Reinforced vending machines) will trigger an alarm that spawns an eyebot. This is fine unless you fail to smash it. Being unable to smash a reinforced vending machine I can spawn an infinite number of eyebots, and using a 13 strength character I can use a normal vending machine with fist attacks for infinite eyebots.

Steps To Reproduce

  1. Find vending machine (or reinforced)
  2. Attempt to smash it with something that won't break it.
  3. Wait a few minutes.
  4. Attempt to smash it again.
  5. Now you have as many eyebots as you want.

Screenshots

image

image

Versions and configuration

Additional context

No response

scarf005 commented 1 year ago

ok, so after looking at the code it goes like this:

  1. vending machine has "ALARMED" flag.
  2. when you kick at vending machine, either map::shoot or map::bash_furn triggers TIMED_EVENT_WANTED event. it also stores position.
  3. TIMED_EVENT_WANTED spawns an eyebot nearby.

i think it's kinda tricky to solve this issue at the moment because there's no easy way to mark how many eyebots are spawned.

RoyalFox2140 commented 1 year ago

This PR from DDA may be relevant to the issue if it wasn't already merged into BN. It appears eyebots used to spawn unlimited riot control bots, and the solution may be relevant to this.

https://github.com/CleverRaven/Cataclysm-DDA/pull/53584

Ignaramico commented 1 year ago

what about a quick hotfix of making the vending machine really easy to break?

RoyalFox2140 commented 1 year ago

That would allow players quick access to tons of medicine in the reinforced vending machines, plus anything else they are set to guard. It would shift the issue from infinite eyebots to easily gaining valuables that used to be hard to access.

chaosvolt commented 1 year ago

When I get home I'll try to look into porting over the linked PR, hopefully.

chaosvolt commented 1 year ago

So, looking at this, the PR kinda fails to actually solve the specific problem being reported here. Infinite eyebots are still perfectly exploitable, that PR only limits how many riot bots they can spawn.

RoyalFox2140 commented 1 year ago

Perhaps its still an issue in DDA. I haven't played it in years to know.