Slashdot Mirror
Integer Overflow Bug Leads To Diablo III Gold Duping
Nerval's Lobster writes "Online economies come with their own issues. Case in point is the Auction House for Diablo III, a massively multiplayer game in which players can pay for items in either in-game gold or real-world dollars. Thanks to a bug in the game's latest patch, players could generate massive amounts of virtual gold with little effort, which threatened to throw the in-game economy seriously out of whack. Diablo series publisher Blizzard took corrective steps, but the bug has already attracted a fair share of buzz on gaming and tech-news forums. 'We're still in the process of auditing Auction House and gold trade transactions,' read Blizzard's note on the Battle.net forums. 'We realize this is an inconvenience for many of our players, and we sincerely apologize for the interruption of the service. We hope to have everything back up as soon as possible.' Blizzard was unable to offer an ETA for when the Auction House would come back. 'We'll continue to provide updates in this thread as they become available.' Diablo's gold issue brings up (however tangentially) some broader issues with virtual currencies, namely the bugs and workarounds that can throw an entire micro-economy out of whack. But then again, 'real world' markets have their own software-related problems: witness Wall Street's periodic 'flash crashes' (caused, many believe, by the rise of ultra-high-speed computer trading)."
It seems likely the gold duping was due to a simple integer overflow bug. A late change added to the patch allowed users to sell gold on the Real Money Auction House in stacks of 10 million rather than stacks of 1 million. On the RMAH, there exists both a cap ($250) and a floor ($0.25) for the value of auctions. With stacks of 1 million and a floor of $0.25, a seller could only enter 1 billion gold (1,000 stacks) while staying under the $250 cap. When the gold stack size increased, the value of gold dropped significantly. At $0.39 per 10 million, a user could enter values of up to 6.4 billion gold at a time. Unfortunately, the RMAH wasn't designed to handle gold numbers above 2^31, or 2,147,483,648 gold. Creating the auction wouldn't remove enough gold, but canceling it would return the full amount.
And this class, is why we use explicit type casting and do sanity checks (checking limits) prior to processing. Now, if you'll look on your screens, you'll see another example of this. Here is a failed mission to Mars, caused because the wrong unit of measurement was put into the computer, a problem caused by the lack of the human brain's compiler to make use of any data type except 'variant' and 'object'... So, what have we learned?
#fuckbeta #iamslashdot #dicemustdie
I remember the day when you could strip the gear off anyone playing a multiplayer game with the trainer. I usually used it on jerks who came in collecting ears. If someone came in you could quickly look at their inventory and if they had several ears you could clear out their inventory and gear. They wouldn't know visually until they tried to hit you at which time they would be completely naked. It was really fun when they re-spawned and came back to loot their body and you started dropping some of the ears they collected on the ground.
What a beginner's mistake. I wonder what the rationale was for not using a 64-bit integer; "It's wasteful!"
Why are they using a signed int for the gold amount? If the lowest gold amount is 0 then you should use an unsigned int which would double the possible value. Although in either case a simple if statement could of prevented this entire issue.
And several arrests - this is computer hacking of exploiting a known bug to your advantage.
It will actually be interesting to see. Historically, people who come up with glitch exploits, even in multiplayer and MMORPG contexts, just get banned for some ToS reason. Blizzard's precious little 'Auction House', of course, might change that. However, I suspect that Blizzard really doesn't want to push the idea that 'in-game items are legally real value' too seriously, both because that could complicate things if players end up 'owning' them, rather than the current "Everything in this game is just intellectual property of blizzard...yadda yadda, licensed not sold,etc.", and because it would be a real blow, to the US customer base, if it were decided that Blizzard was running something closer to a very complex flavor of video poker, rather than a mere video game that you can buy some DLC for.
Obviously Blizzard won't be happy, and the banhammer will see some use; but they might want to tread lightly.
What could Blizzard do? Performing a roll-back would wipe all progress obtained by players for the patch day, which would result in a lot of bad PR. But leaving the economy as-is will devalue all items in the game (and Diablo III is all about getting items).
In the end, Blizzard has not done a roll-back, but instead banned anyone who duped, and refunded anyone who spent real money. The bug was temporarily fixed by reverting the patch note which caused the entire mess.
Why would rolling back 1 day of gameplay be such a disastrous event?
why? because people spent actual money and made actual money?
world was created 5 seconds before this post as it is.
How quaint. I can't remember the last time I saw one of those (except where deliberately created for loop counters etc.).
well, this serves more as an example of how fucked up the game economics already were in D3, because the problem came up from having to increase stack sizing from 1 to 10 million.
I mean, wtf, is diablo 3 set in zimbabwe?
world was created 5 seconds before this post as it is.
Agreed.
Auction House Simulator, aka, Diablo 3, is boring.
Path of Exile is the true spiritual sucessor to Diablo 2, not that piece of garbage called Diablo 3 with cardboard cutout characters. The PoE designers understand the ONE word that made Diablo 2 fun: itemization.
Basically this exact thing happened to Kingdom of Loathing... like 9 years ago... at a time when that game was basically still in beta, and was basically the work of two people, neither of whom would actually have called themselves "programmers" at the time... as opposed to the work of a giant team of professionals releasing a triple-A title... that is mega hilarious.
(Black Sunday: August 8th, 2004, someone discovers that using a particular item, "meat vortex", which under normal circumstances subtracts a handful of the game's currency from your inventory, if you had 0 meat would instead wrap around and give you max meat minus a few, because the game was storing meat in an unsigned int. Fun times!)
I discovered a bug with the gold in Pirates! while watching somebody play on my roommate's Mac (we were stationed in Okinawa on Camp Kinser)... he went into port with damage, and while he did not have enough money, it offered to repair his damaged ships for more money than he had.
Needless to say, the underflow was done to a UINT16 used to track gold (in 10-gold increments), so you'd end up with around 655350 gold after the transaction. That kept your crews happy, and let you buy lots of things.
I also enjoyed the mental image of 1200 pirates hanging off a sloop after I sold off my fleet.
We put in ungodly hours into that game.
because the wall street would be really out of business if someone managed to dupe shares.
Sorry. What you call "duping shares" they call "naked short selling", and they are still very much in business.
... is that Blizzard have often touted the very reason the game carries an always connected requirement is so that they can ensure the economy works correctly and to limit exploits through 3rd party applications. It seems rather clear, however, that the 1st party application is the only one you need to exploit the system. And, as usual, the question must be asked "does this make the game more fun?".
As I see it, this has been Blizzard's only metric for success with Diablo 3, not profitability, as we will see later. They claimed that by breaking the existing mould, they were providing a 'more fun' experience. So, the question then becomes, does the AH or RMAH make the game more fun? Interestingly, Blizzard don't appear to be packaging these components with the Playstation 3 edition. Is that because it turns out all of the changes to Diablo 3 were 'not fun', or is it because Playstation 3 users don't deserve 'as much fun', or is playing with a controller rather than a mouse and keyboard 'so much more fun' that their combination with the AH/RMAH turned into a 'fun overload' that had to be dialled back in order not to blow our puny little minds?
It also asks another important question about the business model. Is always-on net requirements 'more fun', particularly when they don't add anything to play beyond what a direct/lan connection might provide. When you try to enumerate the pros/cons, you see something like:
Pros: Everyone uses the latest version all the time if they want to play
Everyone playing has to have a working key
Cons: Internet Connection must be working to play
Need a server farm in every retail country so that paying customers can play (well, they don't even now, and charge people in those countries more money per copy so that they can have a game that they don't have local server access play)
Servers have to be working in order to play
User account has to be working in order to play
If we rolled out a dodgy patch, everyone will be broken at once
We have to know the product life-cycle prior to release in order to cost all of our servers' TCO correctly.
We have to keep talking to everyone to make sure the game is working to their expectations and forever hear about shortcomings
Economically, I don't understand how game companies are able to turn a profit on a title with those kinds of restrictions and ongoing costs. As a small example, lets say one of your servers can host 200 users at a time, but the server cost $20k, thats $100 per concurrent user before you turn the thing on. Maybe it can host 2000 users at a time, sure but thats still $10 per concurrent user before you turn it on or pay any support personnel, or for space on the floor. Surely, over the life of your product, you would be operating a negative margin without some sort of subscription service. I have read other places that, while you can't place a cost on piracy, you can place a cost and a metric on product returns. Diablo 3 is one of the few games I've ever returned, it was unusable for the first week, and is still, in most parts of the world (outside the US/EU/ASIA) mostly unplayable. Despite that, the parts of the game that were modified to provide 'more fun' actually provided, for me, a fan of the Diablo franchise, 'a lot less fun'.
So, to say that another way, by insisting on Always-Connected, Blizzard not only have to pay a bunch of additional ongoing expenses to run (apparently) necessary infrastructure, its also alienating their core user-base which must be very costly to their bottom line. I don't understand how this course of action renders any kind of net commercial advantage.
Diablo 3 was a bad game that had a garbage economy before this event, and it's still a bad game that has a garbage economy after
Path of Exile is the true spiritual sucessor to Diablo 2
That title goes to the Torchlight series.
The "game" part is just packaging around the pointless grind and universal trade at the auction house. No one does anything for fun after the first time they get through the quests. The game mechanics and itemization are utterly boring and without character. There is not a single aspect of skill involved either. You spend most of your time staring at your skill cooldowns and life-mana pool because the terrain and monsters don't really matter. It's rote repetition and an utter waste of time. Worst purchase I ever made. I'd much MUCH rather have a Diablo 2 expansion with new content and a higher resolution support than this PoS.
https://dalgamotor.wordpress.com/ - Elektronik beyinlere ozgurluk asisi (Turkish)
and then when the IRS drops in and says it's income then all kinds of other laws drop in.
and then when the IRS drops in and says it's income then all kinds of other laws drop in.
The epic hilarity starts if they decide that you'll probably have to account for different sorts of loot in different ways... Did you get the Helm of Epic Bashing while you were wandering around and slaying monsters(self employed), while doing a quest for the Mysterious Feckless Questgiver NPC(Independent Contractor), or should it be reflected in the W-2 that the Ratslayer's Guild submitted to cover your work as an employee with them?
You should probably also get an opinion from your tax lawyer on whether the depletion of the charges stored in your Staff of Fireball is simply part of the depreciation of that capital good, or whether charges are just a business expense like copier paper or potions of stamina...