Introducing Cardwars - page 2. | Bitcointalksearch.org

tomcollins

full member

Activity: 182

Merit: 101

Quote from: luv2drnkbr on May 24, 2011, 01:52:24 AM

Yeah, with the numbers you PM'd me, it's getting up to just under 5 standard deviations, which is significant. Also, BCEmporium, regarding collusion for online poker... There are many forms of cheating that you can and should worry about. Collusion isn't one of them. It's not possible to stop and therefore you shouldn't try.

I ran the numbers and it was 227,000:1 against what happened for 3 players to lose 15, 15, and 30 bets at that game with the incorrect payouts. This means beyond any reasonable doubt, the game was rigged (likely unintentionally, but still not a fair game).

I'm hoping that BCE does the right thing and refunds my money for playing on a rigged game. It would let the entire Bitcoin community know he is committed to running a fair game and if a problem is found, he is willing to come forward and repay players when there is a mistake. It would speak very positively for his casino that as a pioneer, there will be bugs, but if they harm the player, the player will not be taken advantage of.

luv2drnkbr

hero member

Activity: 793

Merit: 1026

Quote from: eturnerx on May 24, 2011, 03:47:39 AM

Quote from: BCEmporium on May 23, 2011, 08:14:09 AM

Even if I'm a "pioneer" and still have some dusty-BTC, I don't have a limitless supply of it.
Being alone also makes things hard, as I've to sleep from time to time leaving the casino on its own.

Keep the stakes low on games until they've run long-enough that you're confident that your code is not exploitable. Place cash-out limits and/or cooldown times before winnings can be cashed out to give yourself time to investigate any large wins that look improbable. Even B&M casinos start watching players who seem to be winning too much. As they leave they'll have casino staff delay them while security reviews the table cameras for anything fishy. A common tactic is to make anybody cashing out above a certain amount to come to a private office - make them wait for the duty manager (who's in a meeting / other delay etc...)
Also consider bringing in help. It'll cost, but worth the peaceful sleep to ensure that the shuffle algorithm are good.

Except in casinos, you can still just walk out with the chips you've won. Unless they have proof of a crime committed they can't hold you. Then you can come back later and cash out the chips. If you're a card counter and being hassled, you simply look the security guard (or suit or whoever is holding you) in the eye and ask them "Are you detaining me against my will?" They'll let you go immediately.

As a business practice BCEmporium should always pay out player money. If there's a flaw in his site, it's not the player's fault, not is the player cheating by merely playing a poorly programmed game. Your idea about only allowing smaller bets on questionable games is a good idea, and I think that should be the way to handle the situation. But not paying out because the game was flawed is unconscionable.

eturnerx

member

Activity: 84

Merit: 10

Quote from: BCEmporium on May 23, 2011, 08:14:09 AM

Even if I'm a "pioneer" and still have some dusty-BTC, I don't have a limitless supply of it.
Being alone also makes things hard, as I've to sleep from time to time leaving the casino on its own.

Keep the stakes low on games until they've run long-enough that you're confident that your code is not exploitable. Place cash-out limits and/or cooldown times before winnings can be cashed out to give yourself time to investigate any large wins that look improbable. Even B&M casinos start watching players who seem to be winning too much. As they leave they'll have casino staff delay them while security reviews the table cameras for anything fishy. A common tactic is to make anybody cashing out above a certain amount to come to a private office - make them wait for the duty manager (who's in a meeting / other delay etc...)
Also consider bringing in help. It'll cost, but worth the peaceful sleep to ensure that the shuffle algorithm are good.

luv2drnkbr

hero member

Activity: 793

Merit: 1026

Yeah, with the numbers you PM'd me, it's getting up to just under 5 standard deviations, which is significant. Also, BCEmporium, regarding collusion for online poker... There are many forms of cheating that you can and should worry about. Collusion isn't one of them. It's not possible to stop and therefore you shouldn't try.

tomcollins

full member

Activity: 182

Merit: 101

I want to thank BTEmporium for opening up his test server to me.

Based on what I have currently found, I think there may be a flaw in the shuffling algorithm used by php to shuffle arrays. I need to investigate further and use a larger sample size, but there's a good chance that there is a flaw in it where certain cards are more likely to be in certain positions.

I'll run some tests tonight and report back. I believe that BTEmporium is trying to run a fair game and is letting me help find any potential problems.

The payout problem with the current rules left a gigantic player advantage (6.8%), which means losing a lot of money over and over is very unlikely with a fair deck. If there was anything that was not fair, it likely was not due to anything intentional by BTE, but by a flaw in php. I'll update this thread with any findings I have.

tomcollins

full member

Activity: 182

Merit: 101

Quote from: BCEmporium on May 23, 2011, 10:09:07 AM

Players will always try to cheat, it's the role of the house to ensure they fail on the attempt.
With poker and low stakes, to not drag in those "cheating sharks", I believe I can put up a pleasant online poker. Players colluding is however a harder issue to deal (specially if they don't use the same IP Address), but that's something for other players in the table to see.

An issue to not need that mils budget is to not run mils tables. If stakes are too low to be "cheating profitable" they should keep their hands off (I believe).

Cheaters gonna cheat. I've played counter-strike for free and people cheat. As long as you are monitoring things to make sure you aren't paying too much, players will have an interest in making sure they identify anything fishy, that should help out.

With a table game, no one is interested in protecting the house except the house and good Samaritans. Players must also trust that they are getting a fair game, and with no 3rd party audits or checks, it's a matter of faith that the programmer did everything correctly and is not devious.

If there is anything else you need from me to help, I am willing to give it a look.

BCEmporium

legendary

Activity: 1218

Merit: 1000

Players will always try to cheat, it's the role of the house to ensure they fail on the attempt.
With poker and low stakes, to not drag in those "cheating sharks", I believe I can put up a pleasant online poker. Players colluding is however a harder issue to deal (specially if they don't use the same IP Address), but that's something for other players in the table to see.

An issue to not need that mils budget is to not run mils tables. If stakes are too low to be "cheating profitable" they should keep their hands off (I believe).

tomcollins

full member

Activity: 182

Merit: 101

Quote from: BCEmporium on May 23, 2011, 09:20:13 AM

There wouldn't still be enough, playing 1 mil hands, by the theory of large numbers it would resemble a game tendency, however it would take a while until 1 million hands get played and that tendency shows of, meanwhile SD will call the shots and it may be to the house... or not.
Therefore on this kind of table games, I'll work towards online poker where the house takes its rake and players deal with each others. Not much to bother there, just keep an eye if the things go fine and if all-ins are well distributed.

For the 1 million hands, you certainly could get a good idea that the game appears to be fair. It shouldn't take that long to simulate (maybe a few hours at most). If you are putting your money on the line in the house, it seems worth it.

Even then there are a lot of considerations. You want to run a fair game. There have been exploits in the past where you could predict what cards were coming due to an improper RNG. Players can cheat and collude with each other. There are potentially a lot of troubles. There's a reason why the major poker sites all have multi-million dollar software budgets.

Best of luck!

BCEmporium

legendary

Activity: 1218

Merit: 1000

There wouldn't still be enough, playing 1 mil hands, by the theory of large numbers it would resemble a game tendency, however it would take a while until 1 million hands get played and that tendency shows of, meanwhile SD will call the shots and it may be to the house... or not.
Therefore on this kind of table games, I'll work towards online poker where the house takes its rake and players deal with each others. Not much to bother there, just keep an eye if the things go fine and if all-ins are well distributed.

tomcollins

full member

Activity: 182

Merit: 101

Quote from: BCEmporium on May 23, 2011, 08:14:09 AM

Even if I'm a "pioneer" and still have some dusty-BTC, I don't have a limitless supply of it.
Being alone also makes things hard, as I've to sleep from time to time leaving the casino on its own.

So far it adds to experience, so I can redo things better, log more... The logging system at testnet creates text files, so it's easy to follow, in that server it goes to db and due to a query error it was logging over the same line (means instead of sequential log I found out pretty few data about the last hand played).

Even the big time casinos can be hit by this kind of stuff. I've seen major sites have flaws in their shuffling algorithm that was exploitable and got hit for a ton of money. But at the very least, calculate the expected odds on a game, then set up an automated test to play a million hands or so, and make sure you are very close to the expected value. Doing that in this case should have caught the problem.

These types of games also can be very easily rigged to favor the house as well (not saying you did this, but others might). So buyer beware on these types of things. It's not very hard to rig a deck so that the player wins less than he should, but still wins close enough to the right amount that he doesn't notice.

BCEmporium

legendary

Activity: 1218

Merit: 1000

Even if I'm a "pioneer" and still have some dusty-BTC, I don't have a limitless supply of it.
Being alone also makes things hard, as I've to sleep from time to time leaving the casino on its own.

So far it adds to experience, so I can redo things better, log more... The logging system at testnet creates text files, so it's easy to follow, in that server it goes to db and due to a query error it was logging over the same line (means instead of sequential log I found out pretty few data about the last hand played).

tomcollins

full member

Activity: 182

Merit: 101

Quote from: BCEmporium on May 23, 2011, 07:52:57 AM

Gosh! Not my coding weekend as it seams.... woke up and found heavy losses at mbtcasino (luckily it was at mbtc), had to rush to put some coins from my wallet to cover it. Sad

I'll retract table card games, it attracts a kind of gambler I'm not quite comfortable with. While slots and lottery attracts relaxed players, table games attracts gamblers filled up with "get rich schemes" and all sorts of statistical rigs along. I would need a 24h/day surveillance system to see what's going on.

tom, late I'll put the cardwars test-net online.

If you make a flaw in your payouts, someone will find it and exploit it. The bug we found potentially saved you a ton of cash. Even with the slots, if there's a mistake in the code, you can get burned hard. However, it's more difficult for a user to find a slot that is paying out better than 100% (plus it's also easy to rig it toward the house).

Having a casino opens you up to a lot of losses even if it's done properly. Hopefully you have it covered in case someone does get lucky.

BCEmporium

legendary

Activity: 1218

Merit: 1000

Gosh! Not my coding weekend as it seams.... woke up and found heavy losses at mbtcasino (luckily it was at mbtc), had to rush to put some coins from my wallet to cover it. Sad

I'll retract table card games, it attracts a kind of gambler I'm not quite comfortable with. While slots and lottery attracts relaxed players, table games attracts gamblers filled up with "get rich schemes" and all sorts of statistical rigs along. I would need a 24h/day surveillance system to see what's going on.

tom, late I'll put the cardwars test-net online.

tomcollins

full member

Activity: 182

Merit: 101

Quote from: luv2drnkbr on May 22, 2011, 10:07:55 PM

I'm not sure whether to feel good or bad that we helped fixed the glitches. I think that next time somebody posts a game with a double payment glitch, I'm going to keep my mouth shut and just play it until they realize the mistake themselves... Making a few hundred bucks off a casino is something I think I can learn to not feel bad about. Wink

I'm still not convinced that it was working properly for real money. The edge we had was quite significant, getting down 30 bets is just so hard to pull off with that edge.

Debugging source code without being to step through it or examine what its actually doing is tough, especially when you don't have all the code.

I'm hoping he has logs of what happened for real money. I see code that looks like it's logging things, so I'd love to look at those. There's always a chance the log is wrong, but it should shed some light on it.

I caught a huge bug in an online poker site. They had a bug where a player could go all in for less than other players. But if he won, he'd win the same amount everyone else bet. For example, someone bets $3 (all he has). The other players raise and stay in for $10 each. So the total pot is $23. If the hand plays properly, the low guy wins $9 if he actually wins, and the winner of the other two gets the other $14. But they would give the low guy $30 out of a $23 pot. I saw one case where the house actually lose >$1000 on one hand. It was a crazy bug. There wasn't a great way to take advantage of it since it didn't always happen. Might as well report it for good karma.

luv2drnkbr

hero member

Activity: 793

Merit: 1026

I'm not sure whether to feel good or bad that we helped fixed the glitches. I think that next time somebody posts a game with a double payment glitch, I'm going to keep my mouth shut and just play it until they realize the mistake themselves... Making a few hundred bucks off a casino is something I think I can learn to not feel bad about. Wink

tomcollins

full member

Activity: 182

Merit: 101

Quote from: BCEmporium on May 22, 2011, 08:00:49 PM

If it helps you to understand what's going "behind the scenes", here's a line of server to client log (from test server):

Tomorrow after fixing it, I'll give you the address to test-net.
Still, the only difference between play and real is that button in the corner; at play it's blue and says play for real / in real it's green and says cashier.

The only difference is supposed to be that, of course, but there is some different code paths, so it's always possible for a bug. I'd like to see the original code on test-net if possible just to pay close attention to the tie situations. Thanks for looking into this, no rush on anything.

BCEmporium

legendary

Activity: 1218

Merit: 1000

If it helps you to understand what's going "behind the scenes", here's a line of server to client log (from test server):

Tomorrow after fixing it, I'll give you the address to test-net.
Still, the only difference between play and real is that button in the corner; at play it's blue and says play for real / in real it's green and says cashier.

tomcollins

full member

Activity: 182

Merit: 101

If I was getting undercharged on war bets and given the full payouts, I must be the most unlucky guy alive to lose that much! I would have had a 3% edge, and was down 30 bets. Maybe a .5% chance of it or worse, so it's always possible I am just unlucky!

Still trying to go through the code, some of it is a bit tricky to read.

If you want me to test using the actual game (I'd like to try in real money mode, but I would of course not keep any of the profit or losses since it would just be for testing), I'm open to it.

BCEmporium

legendary

Activity: 1218

Merit: 1000

Nope, it just calls the same functions, the only difference is in those lines:

if($bank->play == "r"{
goes to real
}else{
goes to play
}

Code:

    require_once("api_engine/classes/cardwars.php");
    $cardwars = new Cardwars($r);

  switch(strtolower($do)){
        case 'init':
                    $bank->setGeneralRealBalance();
                    $bank->getComponentOutPut();
                    $cardwars->init_game();
                    $cardwars->getComponentOutput();
                    $x->doOutput();
                    break;
        case 'deal':
                    $totalbet = 0;

                    foreach($xml->component->bet as $c){
                        $totalbet += $c->attributes()->stake;
                        switch($c->attributes()->name){
                            case 'ante': $cardwars->bet = $c->attributes()->stake;break;
                            case 'tie': $cardwars->tie = $c->attributes()->stake;break;
                        }
                    }

                    $realbet = $totalbet/100;
                    if($bank->play == "r"){
                        if($totalbet/100 > $Player->real){
                            echo "Insufficient funds!";
                            die();
                        }
                        $Player->updateReal(-$realbet);
                    }else{
                        if($totalbet/100 > $Player->free){
                            echo "Insufficient funds!";
                            die();
                        }
                        $Player->updateFree(-$realbet);
                    }

                    $cardwars->start_deck();
                    $cardwars->deal();
                    $bank->setGeneralRealBalance();
                    $bank->getComponentOutPut();
                    $cardwars->getComponentOutput();
                    $x->doOutput();
                    break;

         case 'surrender':
                    $cardwars->surrender();
                    $bank->setGeneralRealBalance();
                    $bank->getComponentOutPut();
                    $cardwars->getComponentOutput();
                    $x->doOutput();
                    break;
         case 'war':
                   $warbet = $cardwars->bet; //Fixed here the double 1/100
                    $realbet = $warbet/100;
                    if($bank->play == "r"){
                        if($warbet/100 > $Player->real){
                            echo "Insufficient funds!";
                            die();
                        }
                        $Player->updateReal(-$realbet);
                    }else{
                        if($totalbet/100 > $Player->free){
                            echo "Insufficient funds!";
                            die();
                        }
                        $Player->updateFree(-$realbet);
                    }

                    $cardwars->warbet = $cardwars->bet;
                    $cardwars->war();
                    $bank->setGeneralRealBalance();
                    $bank->getComponentOutPut();
                    $cardwars->getComponentOutput();
                    $x->doOutput();
                    break;
  }
?>

EDIT: I will go to sleep now. House edge ranges 1,71 ~ 2,88%, I didn't thought much of it because my initial draft for these casinos were to play for pennies, meanwhile btc raised "a bit". I probably will fix and put it back but just in mBTCasino with lower limits; therefore even if I get unlucky with the player on the table, the losses are easily covered.

tomcollins

full member

Activity: 182

Merit: 101

Quote from: BCEmporium on May 22, 2011, 07:29:19 PM

Well... just figured it was double paying on ties and was double 1/100.
This second bug actually covered up the double paying and added that 1% "commission".

initial bug is here:

   case 'war':
   $warbet = $cardwars->bet/100;
   $realbet = $warbet/100;

The switch that calls the functions.
Second bug is in that class.
bug 1 + bug 2 = 1% commission on war ties

This is code you didn't post already, right?

Is it doing something different for real vs. fake money?

I really appreciate you looking at this!

Topic: Introducing Cardwars - page 2. (Read 7088 times)