search

ddnet / ddnet

DDraceNetwork, a free cooperative platformer game
https://ddnet.org
Other
585 stars 415 forks source link

Vote delay circumvention issue #7020

Open bencie opened 1 year ago

bencie commented 1 year ago

Players are able to spam votes (most importantly kick votes) by leaving and rejoining, making them able to vote again without waiting ~2.5 minutes that is usually applied after the vote you started failed. I just noticed this while a player was trying to funvote me out by connecting and reconnect dummy, and they could spam vote after vote by reconnecting dummy and then voting to kick me with their dummy. Perhaps the vote delay could be bound to their IP, so that rejoining is ineffective.

murpii commented 1 year ago

On official servers, sv_join_vote_delay is set to 30.

bencie commented 1 year ago

It's still an issue, because you can rejoin before the vote even ends, and if the vote does not pass by majority votes and all 30 seconds of the vote time pass, you'll still be able to instantly vote after it ends (this circumvents the ~2min delay)

bencie commented 1 month ago

To reproduce, use: sv_vote_time 30; sv_vote_majority 1; sv_vote_delay 180 ;sv_join_vote_delay 30 Votekick someone, instantly rejoin. After the vote doesn't go through because not enough people voted, you're able to instantly initiate a votekick after the last ended, instead of having to wait 180 seconds. You can also vote with dummy, disconnect and reconnect dummy to do the vote, to stay on the server.