uMod - EXPLOIT - Free Money - GUI Shop

Posted 1 year ago

There is a bug where if you try to buy more than you can fit in your inventory, you are refunded back double the price of what you were trying to buy. For instance, I had a player exploit himself almost a million coins over the last 2 days by filling his inventory, trying to purchase 10k wood at 0.5 coins per wood (5k price). He would be charged the 5k, and then refunded 10k. I have replicated this many times, and have had to shut down my shop while I look for the mistake and try to fix it myself for the time being.

From my logs:

[04/13/2025 14:15:08] ¤5,000.00 withdrawn from **MY STEAM ID**
[04/13/2025 14:15:08] ¤63,091.25 set as balance for **MY STEAM ID**
[04/13/2025 14:15:08] ¤10,000.00 deposited to **MY STEAM ID**
[04/13/2025 14:15:08] ¤58,091.25 set as balance for **MY STEAM ID**
[04/13/2025 14:15:08] ¤5,000.00 withdrawn from **MY STEAM ID**
[04/13/2025 14:15:08] ¤68,091.25 set as balance for **MY STEAM ID**
[04/13/2025 14:15:08] ¤10,000.00 deposited to **MY STEAM ID**
[04/13/2025 14:15:08] ¤63,091.25 set as balance for **MY STEAM ID**
[04/13/2025 14:15:08] ¤5,000.00 withdrawn from **MY STEAM ID**
[04/13/2025 14:15:08] ¤73,091.25 set as balance for **MY STEAM ID**
[04/13/2025 14:15:08] ¤10,000.00 deposited to **MY STEAM ID**
[04/13/2025 14:15:09] ¤68,091.25 set as balance for **MY STEAM ID**
[04/13/2025 14:15:09] ¤5,000.00 withdrawn from **MY STEAM ID**
[04/13/2025 14:15:09] ¤78,091.25 set as balance for **MY STEAM ID**
[04/13/2025 14:15:09] ¤10,000.00 deposited to **MY STEAM ID**
[04/13/2025 14:15:09] ¤73,091.25 set as balance for **MY STEAM ID**
[04/13/2025 14:15:09] ¤5,000.00 withdrawn from **MY STEAM ID**
[04/13/2025 14:15:09] ¤83,091.25 set as balance for **MY STEAM ID**
[04/13/2025 14:15:09] ¤10,000.00 deposited to **MY STEAM ID**
[04/13/2025 14:15:09] ¤78,091.25 set as balance for **MY STEAM ID**
[04/13/2025 14:15:09] ¤5,000.00 withdrawn from **MY STEAM ID**
[04/13/2025 14:15:09] ¤88,091.25 set as balance for **MY STEAM ID**
[04/13/2025 14:15:09] ¤10,000.00 deposited to **MY STEAM ID**
[04/13/2025 14:15:09] ¤83,091.25 set as balance for **MY STEAM ID**
[04/13/2025 14:15:09] ¤5,000.00 withdrawn from **MY STEAM ID**
[04/13/2025 14:15:09] ¤93,091.25 set as balance for **MY STEAM ID**
[04/13/2025 14:15:09] ¤10,000.00 deposited to **MY STEAM ID**

Posted 1 year ago

I found the issue. In the GiveItem method, where it checks to see if the player has enough inventory slots:

varslots=FreeSlots(player);

if (slots < stacks)

{

                AddCurrency(shopCategory, player, (data.GetSellPrice(player.UserIDString) * amount),"economics");

returnLang("InventorySlots", player.UserIDString, stacks);

}

AddCurrency should be looking for data.GetBuyPrice for the refund, not GetSellPrice. On our server, for most items the Sell price is twice th Buy Price.

Also near the bottom of the method, where it checks to see if the GiveItem was successful:

if (!GiveItem(player, item))

{

item.Remove();

item.DoRemove();

                    AddCurrency(shopCategory, player, (data.GetSellPrice(player.UserIDString) * value),"economics");

}

Same issue. It is refunding the wrong value, it should be using data.GetBuyPrice