Integer Overflow Bug Leads To Diablo III Gold Duping

Nerval's Lobster writes "Online economies come with their own issues. Case in point is the Auction House for Diablo III, a massively multiplayer game in which players can pay for items in either in-game gold or real-world dollars. Thanks to a bug in the game's latest patch, players could generate massive amounts of virtual gold with little effort, which threatened to throw the in-game economy seriously out of whack. Diablo series publisher Blizzard took corrective steps, but the bug has already attracted a fair share of buzz on gaming and tech-news forums. 'We're still in the process of auditing Auction House and gold trade transactions,' read Blizzard's note on the Battle.net forums. 'We realize this is an inconvenience for many of our players, and we sincerely apologize for the interruption of the service. We hope to have everything back up as soon as possible.' Blizzard was unable to offer an ETA for when the Auction House would come back. 'We'll continue to provide updates in this thread as they become available.' Diablo's gold issue brings up (however tangentially) some broader issues with virtual currencies, namely the bugs and workarounds that can throw an entire micro-economy out of whack. But then again, 'real world' markets have their own software-related problems: witness Wall Street's periodic 'flash crashes' (caused, many believe, by the rise of ultra-high-speed computer trading)." It seems likely the gold duping was due to a simple integer overflow bug. A late change added to the patch allowed users to sell gold on the Real Money Auction House in stacks of 10 million rather than stacks of 1 million. On the RMAH, there exists both a cap ($250) and a floor ($0.25) for the value of auctions. With stacks of 1 million and a floor of $0.25, a seller could only enter 1 billion gold (1,000 stacks) while staying under the $250 cap. When the gold stack size increased, the value of gold dropped significantly. At $0.39 per 10 million, a user could enter values of up to 6.4 billion gold at a time. Unfortunately, the RMAH wasn't designed to handle gold numbers above 2^31, or 2,147,483,648 gold. Creating the auction wouldn't remove enough gold, but canceling it would return the full amount.

Re:Limit checking

[Anonymous Coward]

So, what have we learned?

That C is scaryscary and we're too lazy to do type checking, so we'll keep using the trendy, make-money-now languages, treating this as an outlier that won't happen to us, since we're so smart?

Re:ah the day of the diablo II trainer

[Revek]

You mean the guy with the duped jacked up account that guaranteed that they could one hit you every time? Yeah I messed with his world. Now the guy without the duped jacked up shit I could handle myself. I had fun but I mostly used it to contain the guy who would come in at the 11th hour and whack all of us with his duped gear and finish the game to get some legit gear all to himself. So yes if they played the game like a luser I spanked them.

Re:Confused

[flargleblarg]

You couldn't be more wrong. Signed ints are usually the best way to go in C/C++.

Actually, he's not wrong at all. He said signed integers don't behave in a very predictable manner, and he's right. Signed integers have undefined (actually, to be more precise, implementation-defined) behavior for mod and div of negative values. You cannot be sure whether -4 / 3 is -1 or -2, without knowing how your compiler implements it. Some round toward zero, others toward negative infinity. Recent drafts of C++ are trying to fix this.

Re:Luls.

[ais523]

What's probably more interesting was their fix for the problem. Instead of trying to do any sort of rollback (although they did find people with impossibly high currency amounts and reduce them to saner values), they put a large amount of very expensive trophy items for sale which didn't do anything useful, in the hope that people would put their newfound wealth to an amusing trivial cause.

Diablo 3 is not a game

[SD-Arcadia]

The "game" part is just packaging around the pointless grind and universal trade at the auction house. No one does anything for fun after the first time they get through the quests. The game mechanics and itemization are utterly boring and without character. There is not a single aspect of skill involved either. You spend most of your time staring at your skill cooldowns and life-mana pool because the terrain and monsters don't really matter. It's rote repetition and an utter waste of time. Worst purchase I ever made. I'd much MUCH rather have a Diablo 2 expansion with new content and a higher resolution support than this PoS.