May 9, 2013 at 11:45Diablo III economy wrecked by integer overflow
- Transfer
Blizzard's Diablo III, a popular online Action / RPG released almost a year ago, has received its share of technical issues. From Error 37 to lags that translate into hundreds of wasted hours, but Blizzard spent the past year debugging the backend so that it can better deal with millions of active players.
Diablo III can also be noted for the real economy, with a focus on regional Auction Houses, where players can sell rare items for gold, which amounts to millions and billions (inflation is crazy). In addition, Diablo III uses the Real World Auction House, where players can sell gold or items for real-world money.
Patch 1.0.8 was released yesterday, which was supposed to improve the progress of the characters. After several weeks of testing at the Public Test Realm, where volunteers run a patch in order to understand that it will not do any harm to the game, the patch was successfully published.
Yes, the patch was fully tested in PTR - but with the exception of one minor tweak added at the last minute. And this refinement tore the economy of the game into small pieces.
The final build included the following changes:
As a rule, in Real Money Auction House a player can sell gold in “packs” of 1 million, a maximum of 600 servings. In version 1.0.8, this increment is accordingly increased to 10 million. What will happen when a player tries to bid absurdly large amounts? (it’s absurd because even getting 100 million gold for one player has long been considered an almost impossible task - Blizzard is able to underestimate players)
Reddit user with the nickname tyropro perfectly explains :
Gold could be put up for auction at RMAH, which would not exceed $ 250 when sold in real money. A published video, for example, showed the sale of 6 billion gold - 600 x 10,000,000 at $ 0.39 per stack, in the amount of $ 234. When a player placed such an auction, only about 1.7 billion went on sale, and the rest “disappeared” until the gold returned to the chest and there was already increasing.
Here are the exact numbers from the video:
4,294,967,296 is 2 32 degrees, the limit for an unsigned integer, an interesting implementation by Blizzard.
Simply put, the code for selling gold in RMAH is not able to work with numbers larger than int32, and as a result of overflow, it doubles gold in the pockets of sellers.
So, the attacker can create a 6-billion auction, from which only 1.7 billion will be put up for sale (and, accordingly, only 1.7 billion will be debited from the “cracker” account), cancel it, and get 6 billion back on his account. Net income is 4.2 billion. Repeat until complete satisfaction.
The exploit was shown on one of the sites and quickly spread to people. Anyone who knew about the bug could repeat it.
And the fun began.
Yes, there are 420 billiongold!
After the deceivers bought all the items in the Auction Houses, they put them up for sale at Real Money Auction House. For real money. And people bought them.
And this is the worst case scenario for Diablo III. And all because of a small patch change not tested. What could Blizzard do with this? It would be nice to roll back all the achievements the day before the release of the patch, but this would cause a lot of negative feedback. But it is impossible to leave the economy in this position - this would depreciate objects, and Diablo III is just about objects.
In the end, Blizzard did not roll back, but banned everyone who cheated and returned the money to everyone who spent real money. The change in the patch that caused the chaos was canceled and, accordingly, the problem was temporarily resolved.
And let it be a lesson - last minute changes that have not been tested can lead to the collapse of the entire economy.
From a translator : And this is the second bug in the gaming economy, which became known in less than a week - on Saturday, CCP described how ill-conceived functionality led to almost the same situation in EVE Online . Yes, the economy in games is virtual, but mistakes and / or ill-conceived functionality allow finding ways that simply allow you to bypass long and honest earnings and steal real money already. Interesting features of the new digital world.
Diablo III can also be noted for the real economy, with a focus on regional Auction Houses, where players can sell rare items for gold, which amounts to millions and billions (inflation is crazy). In addition, Diablo III uses the Real World Auction House, where players can sell gold or items for real-world money.
Patch 1.0.8 was released yesterday, which was supposed to improve the progress of the characters. After several weeks of testing at the Public Test Realm, where volunteers run a patch in order to understand that it will not do any harm to the game, the patch was successfully published.
Yes, the patch was fully tested in PTR - but with the exception of one minor tweak added at the last minute. And this refinement tore the economy of the game into small pieces.
The final build included the following changes:
Stack size for selling gold in an auction house increased from 1 million to 10 million.
As a rule, in Real Money Auction House a player can sell gold in “packs” of 1 million, a maximum of 600 servings. In version 1.0.8, this increment is accordingly increased to 10 million. What will happen when a player tries to bid absurdly large amounts? (it’s absurd because even getting 100 million gold for one player has long been considered an almost impossible task - Blizzard is able to underestimate players)
Reddit user with the nickname tyropro perfectly explains :
Gold could be put up for auction at RMAH, which would not exceed $ 250 when sold in real money. A published video, for example, showed the sale of 6 billion gold - 600 x 10,000,000 at $ 0.39 per stack, in the amount of $ 234. When a player placed such an auction, only about 1.7 billion went on sale, and the rest “disappeared” until the gold returned to the chest and there was already increasing.
Here are the exact numbers from the video:
| An RMAH auction is created: | 6,000,000,000 gold |
| Auction is shown as: | 1,705,032,704 gold |
| The missing! | 4,294,967,296 gold |
| Missing if divided by 2: | 2,147,483,648 gold |
4,294,967,296 is 2 32 degrees, the limit for an unsigned integer, an interesting implementation by Blizzard.
Simply put, the code for selling gold in RMAH is not able to work with numbers larger than int32, and as a result of overflow, it doubles gold in the pockets of sellers.
So, the attacker can create a 6-billion auction, from which only 1.7 billion will be put up for sale (and, accordingly, only 1.7 billion will be debited from the “cracker” account), cancel it, and get 6 billion back on his account. Net income is 4.2 billion. Repeat until complete satisfaction.
The exploit was shown on one of the sites and quickly spread to people. Anyone who knew about the bug could repeat it.
And the fun began.
Yes, there are 420 billiongold!
After the deceivers bought all the items in the Auction Houses, they put them up for sale at Real Money Auction House. For real money. And people bought them.
And this is the worst case scenario for Diablo III. And all because of a small patch change not tested. What could Blizzard do with this? It would be nice to roll back all the achievements the day before the release of the patch, but this would cause a lot of negative feedback. But it is impossible to leave the economy in this position - this would depreciate objects, and Diablo III is just about objects.
In the end, Blizzard did not roll back, but banned everyone who cheated and returned the money to everyone who spent real money. The change in the patch that caused the chaos was canceled and, accordingly, the problem was temporarily resolved.
And let it be a lesson - last minute changes that have not been tested can lead to the collapse of the entire economy.
From a translator : And this is the second bug in the gaming economy, which became known in less than a week - on Saturday, CCP described how ill-conceived functionality led to almost the same situation in EVE Online . Yes, the economy in games is virtual, but mistakes and / or ill-conceived functionality allow finding ways that simply allow you to bypass long and honest earnings and steal real money already. Interesting features of the new digital world.