Unexpected Double Claim from Single Wallet

[Leooehh]

Hey! Hope you're doing well,

I've recently noticed an issue where one wallet is claiming more than the allowed limit. Interestingly, there is only one session opened with a legit IP, but two different claims have been made. The limit is set to 2 ETH/24h and 4 ETH/48h.

Here are the details from the logs:

Session Creation:

Timestamp: 2024-06-29 04:26:35

New session for 0xf45CB****a5A75 (IP: 202.*.*.67, ID: 79088f0b-f92c-432a-974e-ed154124b046)

First Claim Transaction:

Timestamp: 2024-06-29 04:25:56

Submitted claim transaction 67128437-86bf-4738-a423-2cea513ff2f3 [2 SepETH] to: 0xf45CB****a5A75: 0x9c819****4c46d

Second Claim Transaction:

Timestamp: 2024-06-29 04:42:32

Submitted claim transaction 79088f0b-f92c-432a-974e-ed154124b046 [2 SepETH] to: 0xf45CB****a5A75: 0x82393*****5b7752

Both me and gpt analyzed around 500 lines of logs around the time stamp but could not find any sessions being openned for 67128437-86bf-4738-a423-2cea513ff2f3 . I also looked for any RPC errors or instabilities but couldnt find any reconnects around that time. Any ideas or past experiences ?

[pk910]

That sounds very alerting o.O

I've found your instance and done some debugging :) Note for future reports: the session id (that UUID) is probably the most sensitive information for a session as it allows fetching the other details (incl. IP & address, etc.) from the api.

So, to get the timeline right, it looks like the following happened (UTC time):

• 2024-06-28 02:46:20 Session 1 created
• 2024-06-28 02:47:47 Session 1 finished mining
• 2024-06-29 04:25:55 Session 1 claimed reward
• 2024-06-29 04:26:34 Session 2 created
• 2024-06-29 04:28:25 Session 2 finished mining
• 2024-06-29 05:42:31 Session 2 claimed reward

Note that the 1st session was created 1 day earlier, so the session was already out of range for the "per 24h check" ;) I guess you have a quite high sessionTimeout configured?

If you're confused how I got that info: https://sepofaucet.xyz/?direct=true#/details/67128437-86bf-4738-a423-2cea513ff2f3 and click on the hidden "show session details" link (which is black on black in your design :D)

[Leooehh]

Damn, you're smart lol.

You are indeed correct on that! I checked the sessions from the day before, and it makes a lot more sense now.

I also double-checked the sessionTimeout, and it was set to 1,800 instead of 1800, sooo yeppp :D.

Thanks for letting me know how you got that info; I was fully flabbergasted at first lol. (Is it normal, though? Should I remove the session details for privacy reasons? or just not sharing the session ID publically should be enough?)

P.S. The black-on-black design is gorgeous! T_T

Once more thank you very much for checking this out! I'll mark this as resolved since it was a common L on my side lol. cheers.