Slashdot Mirror
Integer Overflow Bug Leads To Diablo III Gold Duping
Nerval's Lobster writes "Online economies come with their own issues. Case in point is the Auction House for Diablo III, a massively multiplayer game in which players can pay for items in either in-game gold or real-world dollars. Thanks to a bug in the game's latest patch, players could generate massive amounts of virtual gold with little effort, which threatened to throw the in-game economy seriously out of whack. Diablo series publisher Blizzard took corrective steps, but the bug has already attracted a fair share of buzz on gaming and tech-news forums. 'We're still in the process of auditing Auction House and gold trade transactions,' read Blizzard's note on the Battle.net forums. 'We realize this is an inconvenience for many of our players, and we sincerely apologize for the interruption of the service. We hope to have everything back up as soon as possible.' Blizzard was unable to offer an ETA for when the Auction House would come back. 'We'll continue to provide updates in this thread as they become available.' Diablo's gold issue brings up (however tangentially) some broader issues with virtual currencies, namely the bugs and workarounds that can throw an entire micro-economy out of whack. But then again, 'real world' markets have their own software-related problems: witness Wall Street's periodic 'flash crashes' (caused, many believe, by the rise of ultra-high-speed computer trading)."
It seems likely the gold duping was due to a simple integer overflow bug. A late change added to the patch allowed users to sell gold on the Real Money Auction House in stacks of 10 million rather than stacks of 1 million. On the RMAH, there exists both a cap ($250) and a floor ($0.25) for the value of auctions. With stacks of 1 million and a floor of $0.25, a seller could only enter 1 billion gold (1,000 stacks) while staying under the $250 cap. When the gold stack size increased, the value of gold dropped significantly. At $0.39 per 10 million, a user could enter values of up to 6.4 billion gold at a time. Unfortunately, the RMAH wasn't designed to handle gold numbers above 2^31, or 2,147,483,648 gold. Creating the auction wouldn't remove enough gold, but canceling it would return the full amount.
And this class, is why we use explicit type casting and do sanity checks (checking limits) prior to processing. Now, if you'll look on your screens, you'll see another example of this. Here is a failed mission to Mars, caused because the wrong unit of measurement was put into the computer, a problem caused by the lack of the human brain's compiler to make use of any data type except 'variant' and 'object'... So, what have we learned?
#fuckbeta #iamslashdot #dicemustdie
And several arrests - this is computer hacking of exploiting a known bug to your advantage.
I remember the day when you could strip the gear off anyone playing a multiplayer game with the trainer. I usually used it on jerks who came in collecting ears. If someone came in you could quickly look at their inventory and if they had several ears you could clear out their inventory and gear. They wouldn't know visually until they tried to hit you at which time they would be completely naked. It was really fun when they re-spawned and came back to loot their body and you started dropping some of the ears they collected on the ground.
This bug "threatened to throw the in-game economy seriously out of whack", yet some people had over 2.1 BILLION gold to throw on the AH?
What a beginner's mistake. I wonder what the rationale was for not using a 64-bit integer; "It's wasteful!"
How quaint. I can't remember the last time I saw one of those (except where deliberately created for loop counters etc.).
Part of the reason I stopped playing D3 was hyper-inflation. I didn't want to spend real money on items, but my gold (which I spent a long time collecting) was completely useless for buying items of worth.
Also the game was tuned to make it impossible to farm hell chapter 3-4 without the best items...and the only practical way to get there was to have those items already...which meant buying items...with useless gold. We see the problem here, ja?
What could Blizzard do? Performing a roll-back would wipe all progress obtained by players for the patch day, which would result in a lot of bad PR. But leaving the economy as-is will devalue all items in the game (and Diablo III is all about getting items).
In the end, Blizzard has not done a roll-back, but instead banned anyone who duped, and refunded anyone who spent real money. The bug was temporarily fixed by reverting the patch note which caused the entire mess.
Why would rolling back 1 day of gameplay be such a disastrous event?
[Fuck Beta]
o0t!
Why are they using a signed int for the gold amount? If the lowest gold amount is 0 then you should use an unsigned int which would double the possible value. Although in either case a simple if statement could of prevented this entire issue.
Yes, you are. We can tell, because that's the only sort of person who gets their panties in a twist about TV shows.
Basically this exact thing happened to Kingdom of Loathing... like 9 years ago... at a time when that game was basically still in beta, and was basically the work of two people, neither of whom would actually have called themselves "programmers" at the time... as opposed to the work of a giant team of professionals releasing a triple-A title... that is mega hilarious.
(Black Sunday: August 8th, 2004, someone discovers that using a particular item, "meat vortex", which under normal circumstances subtracts a handful of the game's currency from your inventory, if you had 0 meat would instead wrap around and give you max meat minus a few, because the game was storing meat in an unsigned int. Fun times!)
I discovered a bug with the gold in Pirates! while watching somebody play on my roommate's Mac (we were stationed in Okinawa on Camp Kinser)... he went into port with damage, and while he did not have enough money, it offered to repair his damaged ships for more money than he had.
Needless to say, the underflow was done to a UINT16 used to track gold (in 10-gold increments), so you'd end up with around 655350 gold after the transaction. That kept your crews happy, and let you buy lots of things.
I also enjoyed the mental image of 1200 pirates hanging off a sloop after I sold off my fleet.
We put in ungodly hours into that game.
Diablo III is not an MMO. You are capped at what, 4 people in a game at once? A massively multiplayer online game allows a lot more than that.
If they had used actual bitcoins instead of simulated fiat gold, their simulated economy wouldn't be having simulated inflation.
... is that Blizzard have often touted the very reason the game carries an always connected requirement is so that they can ensure the economy works correctly and to limit exploits through 3rd party applications. It seems rather clear, however, that the 1st party application is the only one you need to exploit the system. And, as usual, the question must be asked "does this make the game more fun?".
As I see it, this has been Blizzard's only metric for success with Diablo 3, not profitability, as we will see later. They claimed that by breaking the existing mould, they were providing a 'more fun' experience. So, the question then becomes, does the AH or RMAH make the game more fun? Interestingly, Blizzard don't appear to be packaging these components with the Playstation 3 edition. Is that because it turns out all of the changes to Diablo 3 were 'not fun', or is it because Playstation 3 users don't deserve 'as much fun', or is playing with a controller rather than a mouse and keyboard 'so much more fun' that their combination with the AH/RMAH turned into a 'fun overload' that had to be dialled back in order not to blow our puny little minds?
It also asks another important question about the business model. Is always-on net requirements 'more fun', particularly when they don't add anything to play beyond what a direct/lan connection might provide. When you try to enumerate the pros/cons, you see something like:
Pros: Everyone uses the latest version all the time if they want to play
Everyone playing has to have a working key
Cons: Internet Connection must be working to play
Need a server farm in every retail country so that paying customers can play (well, they don't even now, and charge people in those countries more money per copy so that they can have a game that they don't have local server access play)
Servers have to be working in order to play
User account has to be working in order to play
If we rolled out a dodgy patch, everyone will be broken at once
We have to know the product life-cycle prior to release in order to cost all of our servers' TCO correctly.
We have to keep talking to everyone to make sure the game is working to their expectations and forever hear about shortcomings
Economically, I don't understand how game companies are able to turn a profit on a title with those kinds of restrictions and ongoing costs. As a small example, lets say one of your servers can host 200 users at a time, but the server cost $20k, thats $100 per concurrent user before you turn the thing on. Maybe it can host 2000 users at a time, sure but thats still $10 per concurrent user before you turn it on or pay any support personnel, or for space on the floor. Surely, over the life of your product, you would be operating a negative margin without some sort of subscription service. I have read other places that, while you can't place a cost on piracy, you can place a cost and a metric on product returns. Diablo 3 is one of the few games I've ever returned, it was unusable for the first week, and is still, in most parts of the world (outside the US/EU/ASIA) mostly unplayable. Despite that, the parts of the game that were modified to provide 'more fun' actually provided, for me, a fan of the Diablo franchise, 'a lot less fun'.
So, to say that another way, by insisting on Always-Connected, Blizzard not only have to pay a bunch of additional ongoing expenses to run (apparently) necessary infrastructure, its also alienating their core user-base which must be very costly to their bottom line. I don't understand how this course of action renders any kind of net commercial advantage.
We duped our gold the way God intended: by pulling an item out of our belt as we picked it up.
Kids these days....
Diablo 3 was a bad game that had a garbage economy before this event, and it's still a bad game that has a garbage economy after
you should check your H1-B's more carefully.
In the very old game, Mordor, you could create a dummy character and trade negative 1 million gold to the. They get negative, you get positive. Then you delete them. This is just barely one step past that (and at least 15 years past that, lol)
I'm not sure how this is a big deal?
After all, pretty soon the only other person still playing is going to know what's going on.
-Styopa
It would be nice if my bank's software had this kind of bug. It would be like winning the lottery... until they learned what happened and wanted their money back! But on a more serious note banks aren't supposed to have these problems because they don't use integers for storing monetary amounts, they use BCD or something along those lines. One of the few nice things that can be said about COBOL is that it natively permits this. No need for a Java BigInteger or BigDecimal class. Furthermore, the IBM mainframes that most COBOL programs run on can do these calculations in hardware (or so I understand).
It's really quite a simple choice: Life, Death, or Los Angeles.
So is it a sitcom that is gay and about asses, or an ass sitcom that is gay, or a sitcom about gay asses?
So basically your argument is to waste a HUGE range just in case one of your coders can't code and can't do basic transactions?
And your "fix" fixes nothing because underflow can happen at negative numbers as well. Basically if you are a coder, you are a lousy one because you took a design decision based on ONE possible occurrence. What if you reached the lowest limit of a signed int and deducted the WRONG amount? You would have fixed NOTHING. Worse, you "fix" the wrong thing that doesn't fix anything rather then fixing the true error, which is that you are both deducting the wrong amount AND more then the game logic should allow.
In any transaction type code, where the amount can't go negative (there is no debt in Diablo as far as I know) because you substract ANY amount, you first check that the amount can be deducted to begin with.
Your an idiot and shouldn't be let near anything more complicated then a stick. A small one.
This is a trivial issue and it has been solved countless times. By any banking software for instance. Really... deducting an amount where the result may not be less then 0... goddamn, I never thought I would encounter anyone who considered that a challenge who also didn't wear a helmet indoors.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
There's only one answer to every problem, that's create more money! There wasn't a bug in the servers, Blizzard just consulted with the FED.
The preceding post was not a Slashvertisement.
The "game" part is just packaging around the pointless grind and universal trade at the auction house. No one does anything for fun after the first time they get through the quests. The game mechanics and itemization are utterly boring and without character. There is not a single aspect of skill involved either. You spend most of your time staring at your skill cooldowns and life-mana pool because the terrain and monsters don't really matter. It's rote repetition and an utter waste of time. Worst purchase I ever made. I'd much MUCH rather have a Diablo 2 expansion with new content and a higher resolution support than this PoS.
https://dalgamotor.wordpress.com/ - Elektronik beyinlere ozgurluk asisi (Turkish)
and then when the IRS drops in and says it's income then all kinds of other laws drop in.
and then when the IRS drops in and says it's income then all kinds of other laws drop in.
The epic hilarity starts if they decide that you'll probably have to account for different sorts of loot in different ways... Did you get the Helm of Epic Bashing while you were wandering around and slaying monsters(self employed), while doing a quest for the Mysterious Feckless Questgiver NPC(Independent Contractor), or should it be reflected in the W-2 that the Ratslayer's Guild submitted to cover your work as an employee with them?
You should probably also get an opinion from your tax lawyer on whether the depletion of the charges stored in your Staff of Fireball is simply part of the depreciation of that capital good, or whether charges are just a business expense like copier paper or potions of stamina...
2^31 = 2,147,483,648 = $21,474,836.48 when counted in pennies. I once worked for a software company where a call came into the support desk from one of our customers accounting departments. Once their sales reached a certain point, their books were suddenly off by exactly that amount (minus 1 cent). While everybody else was scratching their heads about the missing 21 million dollars, I recognized the number, and knew exactly what the problem was. They were storing the number as a 32 bit signed int which had overflowed. That's also how I got promoted from the support desk to a software developer.
IMHO, this is possibly why the max number of bitcoins was designed to be 21 million. Even though the number is not stored as an int in the bitcoin clients, it still avoids a lot of potential problems across platforms, and in scripts, and in data transfer to other systems in other formats. Just a thought.
A multibillion dollar company that has been making games for 20 years makes a mistake like this?
"Embarrassing" doesn't begin to cover it. No company at this level should be making rookie mistakes. The programmers should've known better. Testing should've found this quickly. QA should've audited this. The list of failures goes on.
Calm down! You missed the point entirely!
My argument is not that signed values should be used instead of unsigned. My argument is that unsigned values don't help, and you need to look elsewhere for a solution.
I find it fascinating that the financial industry can solve this, while the gaming industry seems to have so many issues. Part of it, I think, is that games allow much more flexibility in how money is used than you see in real life. Also, the fact that game money isn't real money means that mistakes aren't as important ... but now that line is blurred a bit. Don't trust a gaming company with real money (shocker, I know) .... these sorts of bugs are insanely common.
Your an idiot and shouldn't be let near anything more complicated then a stick. A small one.
Pardon me while I cry in the corner. "Your an idiot" ... priceless.
that there are actually people who STILL play D3.
I expected that noone was p(l)aying that game anymore.
YOU MUST NOT MISS IT! The website cheap wholesale and retail for many kinds of fashion shoes, like the nike,jordan, also including the handbags,sunglasses,jeans,shirts,hat,belt and the watch, All the products are free shipping, and the price is competitive, after the payment, can ship within short time. the goods are shipping by air express, such as EMS,DHL,the shipping time is in 5-7 business days! http://www.sport3trade.net/ cheap jordan for $40, Air Max 90 for $41, air shox for $40, best handbags for $39, Sunglasses for $18, wallet for $19, belt for $18, T-shirts for $20, Jeans for $39, NFL/MLB/NBA jersey for $25, Top Rolex watch,jordan for cheap, http://www.sport3trade.net/
YOU MUST NOT MISS IT! The website cheap wholesale and retail for many kinds of fashion shoes, like the nike,jordan, also including the handbags,sunglasses,jeans,shirts,hat,belt and the watch, All the products are free shipping, and the price is competitive, after the payment, can ship within short time. the goods are shipping by air express, such as EMS,DHL,the shipping time is in 5-7 business days! http://www.sport3trade.net/ cheap jordan for $40, Air Max 90 for $41, air shox for $40, best handbags for $39, Sunglasses for $18, wallet for $19, belt for $18, T-shirts for $20, Jeans for $39, NFL/MLB/NBA jersey for $25, Top Rolex watch,jordan for cheap, http://www.sport3trade.net/