ive already offered just 1 BTC to give the details of the bug allowing for +EV bets, and another .5 BTC for a more serious bug found by dooglus.
I think the issue I found would go away as soon as they fixed the bug that you found to be honest. They're pretty related.
I've been
offline most of the day so haven't been able to keep up with this thread. I'll edit this with replies to later posts as I read them.
We are pretty confident in our code. We log many different hack attempts every day.
Exploit it please, and earn 1 btc. When you do we are willing to pay you 1.5btc extra to tell us about it. We are tired of this lame scam attempts. We get mails of exploits weekly, but no one proved or steal anything. Only reason why we offered you any amount is because you have others users backing you up.
I told you that I verified that he is able to get a 30% edge over the house.
Do you think I'm lying to try to scam 1.5 BTC out of you? Really?
Lol. Foolish remark on Crypto-Games' side. A bug or an exploit shouldn't be taken lightly, especially when it involves money.
Not only that, but it's other people's money they're risking here. They take 'investments'. I wonder if they have any idea who came up with that idea...
ill consider that as an invitation for me and dooglus, we'll start when hes awake.
I don't think I will. The site has the old-fashioned kind of provable fairness where they change the server seed every roll, and so you need to do an awful lot of work to verify the fairness. You would need to note the server seed hash before every roll, change the client seed unpredictably before every roll, then verify that the revealed server seed really hashes to the provided hash and that the two seeds together give the correct roll. Every roll. It's just too much work to expect anyone to do.
No modern dice site uses this kind of provable fairness any more. Even Prime Dice finally switched to using the static server seed + nonce method that Just-Dice pioneered about a year ago after many requests from players.
heres how bad it is, credit goes to dooglus for compiling this:
multiplier, win chance, edge
6613x 0.02% 32.26%
3968x 0.03% 19.04%
2834x 0.04% 13.36%
I have ran simulation for this cases, and don't see any issue with it.... Am I missing something....
Yes! Players expect to win the 0.03% bet once in 3000 rolls. When they do, they are paid 3968 units. If you have a greater than 1/3968 chance of winning 3968 units, that's +EV. In this case it's a 19.04% edge for the player.
It beggars belief you don't recognise the problem even after having it spelled out to you.
As I said this is issue I can't reproduce in my simulator, I won't bother doing math as we have already did. Now we run only simulations....
Is there a grown-up anywhere near you? Maybe get them to help you. For fuck sake man, this is insane.
Or you know, just use fucking maths. Hint: It's two multiplications and one addition. Sum of the probabilities by its respective profit, which gives you the players EV. If it doesn't equal -0.01 you're got the wrong payouts.
Taking the most extremely wrong one:
0.02% chance of 6613x
That's a 0.0002 chance of a profit of 6612, and a (1-0.0002) chance of a profit of -1
Or: 0.0002 * 6612 + (1-0.002)*-1 = 0.3244
...a players advantage of 32.44%
Your math is a little wrong, and overly complicated. The player's edge is 32.26%, not 32.44%:
heres how bad it is, credit goes to dooglus for compiling this:
multiplier, win chance, edge
6613x 0.02% 32.26%
You used 0.002 when you should have used 0.0002:
>>> 0.0002 * 6612 + (1-0.0002)*-1
0.3226
But it's easier just to calculate the payout. It's 0 when the player loses, and 6613 when they win, so return to player per 100 bet is:
>>> 6613 * 0.02
132.26
ie. a 32.26% edge.
You are wrong somewhere as I have entered exact parameters in simulator and result after 10 mil is 0 btc.
Has it occurred to you that it is possible that you might be wrong? The alternative is that everybody else is wrong, since they all seem to be telling you the same thing.
For this 32% issue or whatever it is impossible to reproduce, so you are wrong at some point, not sure where.
Since you don't seem to believe in math, I wrote a simple simulation of the 3968x at 0.03% bet:
#!/usr/bin/env python
import random
payout = 3968
chance = 0.03
starting_balance = 1
bet = 0.00000001
rolls = 10000000
def roll():
return random.randint(0, 9999) < 3
balance = starting_balance
count = 0
while count < rolls:
balance -= bet
if roll():
balance += payout*bet
count += 1
if (count < 100000 and count % 10000 == 0) or count % 100000 == 0:
print "after %10d rolls, risked %7.4f, balance %10.8f, profit = %f%%" % (count, count*bet, balance, 100 * (balance - starting_balance) / (count*bet))
When you run it, the profit is up and down at first, but it settles down after a while:
after 10000 rolls, risked 0.0001, balance 1.00001904, profit = 19.040000%
after 20000 rolls, risked 0.0002, balance 0.99995872, profit = -20.640000%
after 30000 rolls, risked 0.0003, balance 0.99993808, profit = -20.640000%
after 40000 rolls, risked 0.0004, balance 0.99995712, profit = -10.720000%
after 50000 rolls, risked 0.0005, balance 1.00001584, profit = 3.168000%
after 60000 rolls, risked 0.0006, balance 1.00007456, profit = 12.426667%
after 70000 rolls, risked 0.0007, balance 1.00009360, profit = 13.371429%
after 80000 rolls, risked 0.0008, balance 1.00007296, profit = 9.120000%
after 90000 rolls, risked 0.0009, balance 1.00001264, profit = 1.404445%
after 100000 rolls, risked 0.0010, balance 0.99995232, profit = -4.768000%
after 200000 rolls, risked 0.0020, balance 1.00038080, profit = 19.040000%
after 300000 rolls, risked 0.0030, balance 1.00065056, profit = 21.685334%
after 400000 rolls, risked 0.0040, balance 1.00088064, profit = 22.016000%
after 500000 rolls, risked 0.0050, balance 1.00130912, profit = 26.182400%
after 600000 rolls, risked 0.0060, balance 1.00153920, profit = 25.653334%
after 700000 rolls, risked 0.0070, balance 1.00176928, profit = 25.275429%
after 800000 rolls, risked 0.0080, balance 1.00192000, profit = 24.000001%
after 900000 rolls, risked 0.0090, balance 1.00215008, profit = 23.889778%
after 1000000 rolls, risked 0.0100, balance 1.00241984, profit = 24.198401%
...
after 9000000 rolls, risked 0.0900, balance 1.01892160, profit = 21.024001%
after 9100000 rolls, risked 0.0910, balance 1.01895328, profit = 20.827781%
after 9200000 rolls, risked 0.0920, balance 1.01942144, profit = 21.110261%
after 9300000 rolls, risked 0.0930, balance 1.01961184, profit = 21.088001%
after 9400000 rolls, risked 0.0940, balance 1.01972288, profit = 20.981788%
after 9500000 rolls, risked 0.0950, balance 1.02019104, profit = 21.253727%
after 9600000 rolls, risked 0.0960, balance 1.02073856, profit = 21.602667%
after 9700000 rolls, risked 0.0970, balance 1.02096864, profit = 21.617155%
after 9800000 rolls, risked 0.0980, balance 1.02107968, profit = 21.509878%
after 9900000 rolls, risked 0.0990, balance 1.02111136, profit = 21.324607%
after 10000000 rolls, risked 0.1000, balance 1.02118272, profit = 21.182721%
The math predicts a player profit of 19.04%. The simulation shows a player profit of 21% after 10 million rolls. If you ran the simulation for longer, it would settle down at 19.04%. So I guess you either didn't run your simulation for long enough or made an error coding it.
You are the worst sort of idiot. You can't compute basic probability, yet are arrogant. I was wrong in thinking that no one could exploit your site, as you'd wonder why they were betting thousands of bets at a high multiplier, but apparently even when you are told the bug you are too daft to comprehend it. He probably could've bled your bankroll dry and you wouldn't never realized.
When subSTRATA came to me with this and I confirmed it was a real issue, he asked for my advice on how to proceed. I told him I have had mostly bad experiences with bug bounties. Most site operators will stiff you on the bounty if they think they can get away with it. We had a discussion about the morality of making the +EV bets just enough to earn what the feel the bounty is worth, and then reporting it "for free". subSTRATA was very much of the opinion that that would be wrong, and that he would just approach the site directly. I think he assumed that they take his message seriously since I was vouching for the fact that it was real. I think we were both shocked by the arrogance of their response.
Look you idiot, tell me all parameters that he used and I will check.
But if you bet on payout 3968
And roll under 0.3
You don't make any profit at all in 100 million bets. But if I am missing a parameter that you didn't tell me then it's a different story.
You missed a zero. It's 0.03% at 3968x. At 0.3% the profit should be huge, since that's an edge of 0.3 * 3968 - 100 = 1090.4% for the player.
I even gave him a clear mathematical working to only be called an idiot in kind.
You called me idiot first. And yeah, I will miss you very much.
That's different. He called you an idiot because you were being an idiot.
You called him an idiot because you were butthurt.
And thanks for negative feedback whoever gave it to me. Kiddie.
I wouldnt call quickseller of all people a "kiddie...."
Maybe he is a man that can't read then? All issues in this thread were fixed.
I think the biggest issue in this thread is the horrible way you dealt with the whole situation. I can't imagine how you could have been any less professional. I don't have any reason to believe that you will react any differently to future bug reports. Do you?
And I hate red color. I hate math too, but can still code. F***.
You should stop coding. If you don't understand the math underlying the algorithms that you are coding you end up with horrible errors like we have seen here. You are lucky that subSTRATA took the approach he did rather than slowly bleeding your bankroll dry. It seems like there is very little chance you would have ever found out how it was happening considering how hard it was to pound the understanding into you in this thread.
I did about 10,000 rolls at .0002BTC, stopping occasionally. The first 5,000 rolls were hit or miss. The next 5,000 rolls I didn't win any to the point where I needed to cut my bet size down in half. Once I started betting .0001BTC, I never won a single wager.
I had a similar experience yesterday. I had horrible losing streaks, but put it down to variance. I didn't keep logs at all, and didn't have any kind of seed logging in place either.
The site claims to be provably fair, but for all intents and purposes the amount of work the player needs to put in to verify the fairness means it may as well not be.
They should change to use a system like Just-Dice uses, where the player can make a million rolls at <0.02% and then at the end reveal their server seed and easily check how many times they should have won by running the provably fair algorithm in a loop with a single seed pair and an ever-changing nonce. Lots of sites have adopted that system - it's free for anyone to use.
if dooglus wants to post one too ill gladly edit it into the op, the guy really deserves credit for finding some back-end bugs.
1JtD6uG43feZrUqgxTYsQAPTmgmq8hogCt is an address for me. But don't feel the need to tip me - I didn't do anything other than vouch for subSTRATA's find.
Wait, so Dooglus blackmails other sites too? word it anyway you want but this was blackmail, pay my price or I release / sell the exploit that would harm not only the owner but innocent investors who probably didn't know better.
right? Or am I missing something here?
No, here's how I do it: I email the site and disclose the bug report up front. Then they try to find excuses not to pay me. Sometimes they end up paying something, but most often I get nothing.
In this case I was merely vouching for subSTRATA. He didn't want to get ripped off by the site and so wanted to get paid up front. They wouldn't believe him if I didn't vouch for him. And didn't believe him that I did. Ho hum.
I don't think anyone was threatening to release or sell the exploit, but maybe I'm wrong.
"I have found an issue with your site that others could potentially use to steal from you, I have no intention of disclosing it to anyone other then you, nor do I have any intention of using such exploit personally, although I cannot guarantee that others will not use the same public information to exploit this same issue."
I think the above would pass the test of not being blackmail, while still being reasonably compensated for your time/skills.
The fact is that gambling sites are for-profit entities, and giving advice as to how to prevent yourself from getting robbed when large amounts of money is at stake should not be given for free. These sites should invest in the time/effort to prevent these kinds of exploits from existing in the first place.
Exactly. It is common practice for gambling sites NOT to reward people who help them fix security holes, and so it doesn't seem unreasonable to withhold information until the reward is paid. Their site contains text claiming that the DO reward people who report bugs, and so it doesn't seem unreasonable to use what is effectively an escrow to hold knowledge of the bug in exchange for the reward.
Or, in other words: They say "we pay for bugs". There is a history of sites breaking that promise, and so using a "bug escrow" (like me) seems reasonable. And not like blackmail at all.
it may be that your ip/account is blacklisted to skip nonces or something of the sort.
No need to skip nonces. The site doesn't use them. It makes up a new server seed for each roll.
