unlimited sell exploit

[npwd-community]

unlimited sell exploit

[LiamDormon]

All of the transactions are handled by the server so the UI won't update instantly but the server should be keeping check of the balance

[JKellyEPCG]

No, he's right. I had a person discover if you have something like .0999999999 in crypto, and you sell .099999, he keeps getting $7.xxxxxxx over and over and over. He had 2 coins but couldn't sell 2 coins. So he did 1, then .5, and cut it in half until down to .09999 and ended up spamming that and making a little over $100k. You may have a problem where it's not rounding properly or something along those lines.

[bruinp8n]

I'm not very familiar with typescript, so I cant really debug very well, but I also had another user sell crypto 6mil worth of crypto, it didn't update, and then allowed him to sell again, even though they no longer have crypto..

So there seems to be a slight syncing issue somewhere and possibly relies on the client for the amount?

[LiamDormon]

Is this on ESX or QB?

npwd_crypto/server/server.ts

Lines 145 to 157 in c3d2115

	const playerCryptos = fwWrapper.getCryptos(src)
	if (playerCryptos <= amount) {
	return res({
	status: "error",
	data: {
	reason: "Insufficient Crypto Portfolio"
	}
	})
	}
	const worth = amount * controller.currentValue
	fwWrapper.takeCryptos(src, amount)
	fwWrapper.giveBank(src, worth)

All of the transaction is handled on the server here, the client serves only to relay messages between UI and Server, it knows nothing.

[LiamDormon]

Best I can do is a rate limiter to prevent spam

[JKellyEPCG]

It's qbcore for my experience. It never goes down for .099999999 if you keep selling it at .099999 but you'll make money each time. It was at $7.xxxx per sale

[LiamDormon]

Rate limiting added to prevent spam exploits

[JKellyEPCG]

Rate limiting added to prevent spam exploits

Thanks, I'll let you know if we experience any further problems on that end.

[cmgjones]

issue continues only when a 3rd decimal place is used , They just wait and click and again . Any way of limiting selling to whole numbers or 2 dp.