crypto-games.net, 30% house edge, bugs and vulnerabilities, screw the investors! - page 13.

subSTRATA

legendary

Activity: 1288

Merit: 1043

:^)

Quote from: Quickseller on July 03, 2015, 09:04:39 AM

Quote from: Emerge on July 03, 2015, 08:58:02 AM

Quote from: subSTRATA on July 03, 2015, 08:48:38 AM

Quote from: Quickseller on July 03, 2015, 08:46:18 AM

If someone were to exploit/employ the +EV strategy on your site, then it would appear that they are simply getting lucky. Also there would be nothing that would stop someone from making small amounts of money across multiple accounts so they would each be under the radar.

Based on posts in this thread, it looks like the OP was offered a total of .5 BTC for his disclosure.

there were 2 bugs, 1 for the +EV bug and a second bug that dooglus found that would allow for players to manipulate some bet data to exceed that parameters set by the site, which i thought 1.5 BTC in total would be more than fair for the disclosure and explanation of these, but upon hearing of the second bug, the admin started getting rather hostile in tone and dissuaded me from accepting any sort of deal.

Well, the EV Bug was so easy to find that it was revealed by a player.
Still watching this thing though.

Was the EV bug leaked? If so then what was it? If not then don't leak it.

it was a simple rounding error; the site's client allowed the player to choose a multiplier up to 6500x, every number inclusive. however, their % win chance was rounded to the hundredth place (decimal), allowing for a 0.02% win chance on a 6500x roll, when the correct multiplier for such a roll should be around 5000. this is the worse case scenario allowing for a 30% edge, but as dooglus pointed out above, the second bug allows for even more of an edge.

FanEagle

legendary

Activity: 3066

Merit: 1129

Eh, when owners listen to the users only when they want to be too honest.
I bet if the user was an uncorrect and used the ev+ method just for personal profit the owner would just pay.
Now that even the owner knows the problem, is in hurry to fix it Cool

If I only was smart enough to bug find on sites... i would be rich Tongue

Quickseller

copper member

Activity: 2996

Merit: 2374

Quote from: Emerge on July 03, 2015, 08:58:02 AM

Quote from: subSTRATA on July 03, 2015, 08:48:38 AM

Quote from: Quickseller on July 03, 2015, 08:46:18 AM

If someone were to exploit/employ the +EV strategy on your site, then it would appear that they are simply getting lucky. Also there would be nothing that would stop someone from making small amounts of money across multiple accounts so they would each be under the radar.

Based on posts in this thread, it looks like the OP was offered a total of .5 BTC for his disclosure.

there were 2 bugs, 1 for the +EV bug and a second bug that dooglus found that would allow for players to manipulate some bet data to exceed that parameters set by the site, which i thought 1.5 BTC in total would be more than fair for the disclosure and explanation of these, but upon hearing of the second bug, the admin started getting rather hostile in tone and dissuaded me from accepting any sort of deal.

Well, the EV Bug was so easy to find that it was revealed by a player.
Still watching this thing though.

Was the EV bug leaked? If so then what was it? If not then don't leak it.

subSTRATA

legendary

Activity: 1288

Merit: 1043

:^)

Quote from: waterpile on July 03, 2015, 09:01:24 AM

Quote from: joter85 on July 03, 2015, 07:43:54 AM

We are pretty confident in our code.

Sure you are and now there are many bugs to find

if i were in his position, i would be scouring the code line for line at this moment; as i mentioned before in the thread, there is another bug that dooglus found (all credit goes to dooglus on this one) that allows a player to manipulate their bet to exceed the parameters given by the client. this is all client-side. that alone should be a gigantic red alarm for any developer, especially one that is "confident in their code."

arallmuus

legendary

Activity: 2562

Merit: 1414

Quote from: subSTRATA on July 03, 2015, 08:48:38 AM

but upon hearing of the second bug, the admin started getting rather hostile in tone and dissuaded me from accepting any sort of deal.

It seems like he is too proud with his site and the code while in fact is that this site is barely touched or known around here . With his statement here, he is digging his own graveyard for his site because +30 % means a bad things for his investor as well .
On the other note, he keeps on luring you to "exploit" the site which means that he will log through your games and finds out how you did them. This is such a cheap way to not pay the bounty

Regarding the bolded part, it seems like he is always hostile in tone even to his player ( which is something that a site owner shouldnt do )

Quote from: joter85 on June 26, 2015, 12:35:48 PM

Quote from: lastchanceclochard on June 26, 2015, 12:20:08 PM

up to 20,500 ? it's impossible!
-snip-

-snip-
if you don't like it just don't play. LOL

waterpile

hero member

Activity: 602

Merit: 500

Quote from: Emerge on July 03, 2015, 08:58:02 AM

Quote from: subSTRATA on July 03, 2015, 08:48:38 AM

Quote from: Quickseller on July 03, 2015, 08:46:18 AM

If someone were to exploit/employ the +EV strategy on your site, then it would appear that they are simply getting lucky. Also there would be nothing that would stop someone from making small amounts of money across multiple accounts so they would each be under the radar.

Based on posts in this thread, it looks like the OP was offered a total of .5 BTC for his disclosure.

there were 2 bugs, 1 for the +EV bug and a second bug that dooglus found that would allow for players to manipulate some bet data to exceed that parameters set by the site, which i thought 1.5 BTC in total would be more than fair for the disclosure and explanation of these, but upon hearing of the second bug, the admin started getting rather hostile in tone and dissuaded me from accepting any sort of deal.

Well, the EV Bug was so easy to find that it was revealed by a player.
Still watching this thing though.

yup, it took him minutes to find it lol..

Quote from: joter85 on July 03, 2015, 07:43:54 AM

We are pretty confident in our code.

Sure you are and now there are many bugs to find

subSTRATA

legendary

Activity: 1288

Merit: 1043

:^)

Quote from: Emerge on July 03, 2015, 08:58:02 AM

Quote from: subSTRATA on July 03, 2015, 08:48:38 AM

Quote from: Quickseller on July 03, 2015, 08:46:18 AM

If someone were to exploit/employ the +EV strategy on your site, then it would appear that they are simply getting lucky. Also there would be nothing that would stop someone from making small amounts of money across multiple accounts so they would each be under the radar.

Based on posts in this thread, it looks like the OP was offered a total of .5 BTC for his disclosure.

there were 2 bugs, 1 for the +EV bug and a second bug that dooglus found that would allow for players to manipulate some bet data to exceed that parameters set by the site, which i thought 1.5 BTC in total would be more than fair for the disclosure and explanation of these, but upon hearing of the second bug, the admin started getting rather hostile in tone and dissuaded me from accepting any sort of deal.

Well, the EV Bug was so easy to find that it was revealed by a player.
Still watching this thing though.

so it would seem, it really wasnt that hard to see honestly, was more so wondering why that was even there in the first place. im expecting that to be fixed rather quickly, which is good for their script, but as for their publicity, thats rather questionable.

Emerge

legendary

Activity: 854

Merit: 1000

Quote from: subSTRATA on July 03, 2015, 08:48:38 AM

Quote from: Quickseller on July 03, 2015, 08:46:18 AM

If someone were to exploit/employ the +EV strategy on your site, then it would appear that they are simply getting lucky. Also there would be nothing that would stop someone from making small amounts of money across multiple accounts so they would each be under the radar.

Based on posts in this thread, it looks like the OP was offered a total of .5 BTC for his disclosure.

there were 2 bugs, 1 for the +EV bug and a second bug that dooglus found that would allow for players to manipulate some bet data to exceed that parameters set by the site, which i thought 1.5 BTC in total would be more than fair for the disclosure and explanation of these, but upon hearing of the second bug, the admin started getting rather hostile in tone and dissuaded me from accepting any sort of deal.

Well, the EV Bug was so easy to find that it was revealed by a player.
Still watching this thing though.

subSTRATA

legendary

Activity: 1288

Merit: 1043

:^)

Quote from: Quickseller on July 03, 2015, 08:46:18 AM

If someone were to exploit/employ the +EV strategy on your site, then it would appear that they are simply getting lucky. Also there would be nothing that would stop someone from making small amounts of money across multiple accounts so they would each be under the radar.

Based on posts in this thread, it looks like the OP was offered a total of .5 BTC for his disclosure.

there were 2 bugs, 1 for the +EV bug and a second bug that dooglus found that would allow for players to manipulate some bet data to exceed that parameters set by the site, which i thought 1.5 BTC in total would be more than fair for the disclosure and explanation of these, but upon hearing of the second bug, the admin started getting rather hostile in tone and dissuaded me from accepting any sort of deal.

Quickseller

copper member

Activity: 2996

Merit: 2374

Quote from: joter85 on July 03, 2015, 08:38:01 AM

Quote from: Quickseller on July 03, 2015, 08:22:45 AM

Quote from: joter85 on July 03, 2015, 08:19:01 AM

Quote from: subSTRATA on July 03, 2015, 08:17:02 AM

Quote from: joter85 on July 03, 2015, 08:15:31 AM

Quote from: subSTRATA on July 03, 2015, 08:13:57 AM

Quote from: Emerge on July 03, 2015, 08:10:51 AM

Quote from: subSTRATA on July 03, 2015, 08:08:42 AM

Quote from: Quickseller on July 03, 2015, 08:01:38 AM

I am not even sure that I would trust the site to pay out large wins that a +EV strategy would result in. The site is very new, has a tiny bankroll, and is acting very unprofessionally.

big point here; even if they decide to pay out, their decisions in handling this entire matter were questionable at best, announcing their site as the subject of this thread was probably the biggest mistake, this is a lose-lose situation for them now.

Yeah, and it's not only them at risk, but also investor's money.
Them being "confident" is totally going to bring a lot of people down.

Time to take a couple of last looks at the site lol.

great point, after this, their site is dead regardless of the outcome. inviting people to come and dump your bankroll and not even consulting with your investors? that's some special publicity right there.

How do you know we didn't notify our investors? Did you ask them? We have notified every single investor on site.

in my opinion, before pulling this sort of stunt you should notify your investors ahead of time and give them time to process their withdrawals, just go and pull the trigger and invite people to dump their investments. judging from the timeframe between the messages and the announcement you made, your investors had little to no time to make a decision regarding the matter.

Not sure if you understand how our system works. But one thing is sure, investors have priority before players. And almost all of our funds are on cold wallets. So all will receive their funds if they want to withdraw it.

So what you are saying is that if a player were to win with this strategy, that you would not pay out the player?

The fact that you have investors means that you need to act in their best interest. Not paying out a measly 1 btc bug bounty for something that you are most likely responsible for only shows how bad of an idea it is to invest at your site.

We said we would pay you 1 btc and no more. But you didn't want to talk about it. So we have decided we won't talk with you either. We will have to wait for you to start earning "serious money", then we will fix it. But as you can read in terms, every exploit or bug should be reported and abuses are not allowed. If we see you abuse it you will stay without your funds.

It is your bad that you didn't want 1 btc, not ours.

To be clear, I have had no prior communications with you in the past. I do not see that anywhere in your terms on your website.

If someone were to exploit/employ the +EV strategy on your site, then it would appear that they are simply getting lucky. Also there would be nothing that would stop someone from making small amounts of money across multiple accounts so they would each be under the radar.

Based on posts in this thread, it looks like the OP was offered a total of .5 BTC for his disclosure.

joter85

sr. member

Activity: 395

Merit: 255

crypto.games: #1 Gambling Site

Quote from: subSTRATA on July 03, 2015, 08:40:07 AM

Quote from: joter85 on July 03, 2015, 08:38:01 AM

We said we would pay you 1 btc and no more. But you didn't want to talk about it. So we have decided we won't talk with you either. We will have to wait for you to start earning "serious money", then we will fix it. But as you can read in terms, every exploit or bug should be reported and abuses are not allowed. If we see you abuse it you will stay without your funds.

It is your bad that you didn't want 1 btc, not ours.

and it is also your problem that you practically killed off your own site. you just publicly stated that you will not pay out, right there. say good bye to crypto-games.net.

Really, I don't see anyone exploiting anything, and all works fine for me. Not sure what you are talking about Wink