TFS 1.X+ Bot Allows Players to Essentially Steal from Shops

[Garfelt]

So this is a server breaking issue in my opinion. When you do a supply run with vbot and you don't have enough money it still gives the items. If you have enough for the entire transaction it will take it, but if you have even a little less it won't charge anything. The npc's trade using the normal trade window.
Any way to fix this server side?

 

[drakylucas]

First thing anyone would need to know is which engine are you using.

This is probably a bug in old engines that is already fixed.

 

[Garfelt]

Sorry, it's TFS 1.2

 

[Codinablack]

Sorry, it's TFS 1.2

Let's see the script. Would need to see the npc script that is doing the selling or is it every single npc that sells any kind of item?

 

[Garfelt]

It's all of them. It's through the normal trade window. So the npc is just calling the trade, not really doing anything.

 

[oen432]

Best option is to update the server to 1.4. If you are encountering exploits like this, what else is waiting in this outdated version?

 

[Garfelt]

That would be the best solution, but is there a way to do that without messing up all my npc's and everything else? I'm not too worried about exploits because it's just a small group of friends on my server, but this one can be easily triggered accidentally which is the main issue

 

[Evil Puncker]

try to at very least update the npc libs:

forgottenserver/data/npc/lib at 1.4 · otland/forgottenserver

A free and open-source MMORPG server emulator written in C++ - otland/forgottenserver

github.com

(make backup first)

 

[Garfelt]

Just tried that. A lot of npc's had syntax errors and didn't load in. I tested it anyway on one that did load and it still happened.

I found a solution that works for me. This let's the npc debit directly from your bank account. With this it doesn't allow the bot to buy items if there isn't enough gold in the account.

NPC working with balance.

After 10.94: Premium players no longer need to bring any money to pay for services or wares, as the concerned NPCs now deducts any money missing from their inventory from their Bank Account. Place this at the first line of npc/lib/npcsystem/modules.lua: function Player.removeMoneyNpc(self...

otland.net

 

[Gesior.pl]

I saw this report before. Someone used some dumb custom NPC, that removed money, without checking if it was removed (engine returned of course 'false') and then give items. It was possible, when player spammed 'buy' button with high ping - it delayed change of 'Buy' button in client to gray (after removing money). It was also possible with bot, no money required, just send modified network packet.
It's not part of TFS 1.2.

Like:

doRemoveMoney(cid, cost)
doPlayerAddItem(cid, itemid)

It should be:

if doRemoveMoney(cid, cost) then
    doPlayerAddItem(cid, itemid)
else
    doPlayerSendTextMessage(messagE_type, "you dont have money")
end

TFS 1.2 trade window buy callback:

forgottenserver/data/npc/lib/npcsystem/modules.lua at 1.2 · otland/forgottenserver

A free and open-source MMORPG server emulator written in C++ - otland/forgottenserver

github.com

no money = no items
TFS 1.2 trade window sell callback:

forgottenserver/data/npc/lib/npcsystem/modules.lua at 1.2 · otland/forgottenserver

A free and open-source MMORPG server emulator written in C++ - otland/forgottenserver

github.com

no items = no money