How best to report vulnerabilities?

[Odusko]

Without saying which game it is and which provider it belongs to, could you explain what kind of loophole or bug it is precisely and how it works exactly? Are you sure you're not just encountering a long winning streak on this game. Because one time I got many wining rounds in a row, and I really though the game was bugged but unfortunately it didn't continue like that for long and I lose almost all the winnings I made at the end. 

I think ops will not want to mention the name since he is trying every possible efforts to get the game provider attention to fix the bug, I don't know why a casino should take such a report with laxity.
What if ops decide to keep it to himself and continue to exploit the loophole and take advantage of the bug to exploit and abuse the casino system?
That could lead to more severe outcomes for both casino and the player and possibly the player could walk away knowing already what is involved in exploiting such loopholes.

[1715316704]

1715316704

[1715316704]

1715316704

[1715316704]

1715316704

[1715316704]

1715316704

[ethereumhunter]

Without saying which game it is and which provider it belongs to, could you explain what kind of loophole or bug it is precisely and how it works exactly? Are you sure you're not just encountering a long winning streak on this game. Because one time I got many wining rounds in a row, and I really though the game was bugged but unfortunately it didn't continue like that for long and I lose almost all the winnings I made at the end. 

I think ops will not want to mention the name since he is trying every possible efforts to get the game provider attention to fix the bug, I don't know why a casino should take such a report with laxity.
What if ops decide to keep it to himself and continue to exploit the loophole and take advantage of the bug to exploit and abuse the casino system?
That could lead to more severe outcomes for both casino and the player and possibly the player could walk away knowing already what is involved in exploiting such loopholes.

It's normal that @OP doesn't want to say the name of the game and which casino it's from because he doesn't seem to want people to know about it and then have them report it to the casino so those people will get the bounty for finding the bug. And if the @OP decides not to report it to the casino and instead uses the bug to its own advantage, the casino will find out sooner or later because the casino can see who has a winning streak or can win a lot. And if the casino suspects it, the casino can investigate it and if it finds that @OP has cheated, the casino will freeze his account and not allow @OP to play again. This will prevent @OP from being able to gamble at that casino again, even though he can still gamble at other casinos.

[robelneo]

So I discovered a bug affecting a mode of play at OwlGames casinos that results in certain games rewarding more money than they should.  I tried to report it to OwlGames but was told that they have no bug bounty program and to "enjoy the bug" (not kidding).  (of course their docs say that any "exploit" can result in not being paid out, but it's not an exploit if it's simply how things run under the given conditions - not that that would stop them from screwing someone over I'm sure)

Their poor attitude certainly doesn't do much to make me want to help them out anymore although that was my intent.

 
Include the screenshot of the conversation if you still have it or you can retrieve it, they might accuse you of just making up a story.
 
They have an obligation to report a bug or entertain people that find a bug because this is a trap, in the end, Owlgame will ban people for exploiting a bug, and some players unknowingly play the game and win money, and because of the bug they cannot cashout what they've won and get a ban instead.
Owlgame should address this issue as it puts its reputation at risk.

[AicecreaME]

So I discovered a bug affecting a mode of play at OwlGames casinos that results in certain games rewarding more money than they should.  I tried to report it to OwlGames but was told that they have no bug bounty program and to "enjoy the bug" (not kidding).  (of course their docs say that any "exploit" can result in not being paid out, but it's not an exploit if it's simply how things run under the given conditions - not that that would stop them from screwing someone over I'm sure)

Their poor attitude certainly doesn't do much to make me want to help them out anymore although that was my intent. 

But since it is only certain games, from 1 provider, should I try to contact that provider instead?  It's possible I imagine that it's not just OwlGames that might possibly lose money to the issue, though I really don't know.

I guess since these are casinos, losing a couple hundred to a few players every few days that would otherwise not have won anything maybe is just a drop in the bucket.  But I found it so strange that they immediately just alerted me that they have no bounty program.  Aren't casinos supposed to be pretty protective of their money even if they have a ton of it? 

Anyone else have any experiences of trying to report issues like this?  I want to be rewarded for my time verifying the issue without taking advantage of it and alerting someone about it, too, so I'm also just worried about giving the info out and having them come up with some excuse like "oh it just needed a restart it's fine now, that's not a bug."

If that's their response towards you, then they aren't open for feedback and are slacking off their jobs to maintain the casino abuse-free which is really a cause of concern since these abusive activities are prohibited in the first place. Why would they even say a statement of enjoying the bug, if really there is any instead of acknowledging their shortcomings and giving a reward? Perhaps they are just too complacent and too confident that it won't happen, or they just don't want to acknowledge your report because they have to give a reward, which they don't want to.

Check whether the casino still have this bug and if they do, they probably are just confident and slacking off maintaining the casino away from glitches. If it suddenly don't have it after you reported, then most probably they have taken an action about your concern but decided not to credit you for noticing which I believe is such a jerk move if ever it is the latter reason.

[TimeTeller]

If that's their response towards you, then they aren't open for feedback and are slacking off their jobs to maintain the casino abuse-free which is really a cause of concern since these abusive activities are prohibited in the first place. Why would they even say a statement of enjoying the bug, if really there is any instead of acknowledging their shortcomings and giving a reward? Perhaps they are just too complacent and too confident that it won't happen, or they just don't want to acknowledge your report because they have to give a reward, which they don't want to.

Check whether the casino still have this bug and if they do, they probably are just confident and slacking off maintaining the casino away from glitches. If it suddenly don't have it after you reported, then most probably they have taken an action about your concern but decided not to credit you for noticing which I believe is such a jerk move if ever it is the latter reason.

I am thinking that they don't want to acknowledge but they are doing in the background to address the issue.
Yes, the OP can check if the bug is still not fix, either their team is not addressing it or they don't know how to address it.
If you have done your job of informing them and they just shrugged it off, it means, they should not blame anyone if another user found the bug and exploited it.
I believe, not all gambling sites have that kind of reaction towards a user who is reporting a bug, some will entertain your report and may possibly give you a reward or bonus though.

[coin-investor]

So I discovered a bug affecting a mode of play at OwlGames casinos that results in certain games rewarding more money than they should.  I tried to report it to OwlGames but was told that they have no bug bounty program and to "enjoy the bug" (not kidding).  (of course their docs say that any "exploit" can result in not being paid out, but it's not an exploit if it's simply how things run under the given conditions - not that that would stop them from screwing someone over I'm sure)

Their poor attitude certainly doesn't do much to make me want to help them out anymore although that was my intent. 

But since it is only certain games, from 1 provider, should I try to contact that provider instead?  It's possible I imagine that it's not just OwlGames that might possibly lose money to the issue, though I really don't know.

I guess since these are casinos, losing a couple hundred to a few players every few days that would otherwise not have won anything maybe is just a drop in the bucket.  But I found it so strange that they immediately just alerted me that they have no bounty program.  Aren't casinos supposed to be pretty protective of their money even if they have a ton of it? 

Anyone else have any experiences of trying to report issues like this?  I want to be rewarded for my time verifying the issue without taking advantage of it and alerting someone about it, too, so I'm also just worried about giving the info out and having them come up with some excuse like "oh it just needed a restart it's fine now, that's not a bug."

If that's their response towards you, then they aren't open for feedback and are slacking off their jobs to maintain the casino abuse-free which is really a cause of concern since these abusive activities are prohibited in the first place. Why would they even say a statement of enjoying the bug, if really there is any instead of acknowledging their shortcomings and giving a reward? Perhaps they are just too complacent and too confident that it won't happen, or they just don't want to acknowledge your report because they have to give a reward, which they don't want to.

Check whether the casino still have this bug and if they do, they probably are just confident and slacking off maintaining the casino away from glitches. If it suddenly don't have it after you reported, then most probably they have taken an action about your concern but decided not to credit you for noticing which I believe is such a jerk move if ever it is the latter reason.

Either way that's a bad attitude they should at least acknowledge the report, even if they are not giving rewards at least they should be considerate enough to acknowledge, with that kind of answer they don't care because coming from their own mouth if this is true they will just not honor coming from bugs, the gambler is the one that will suffer because he thought his winning comes in playing fair, it turned out there is a bug, I want to see Owlgame answer into this allegation this is serious and gamblers will opted not to play in their platform.

[BenCodie]

So I discovered a bug affecting a mode of play at OwlGames casinos that results in certain games rewarding more money than they should.  I tried to report it to OwlGames but was told that they have no bug bounty program and to "enjoy the bug" (not kidding).  (of course their docs say that any "exploit" can result in not being paid out, but it's not an exploit if it's simply how things run under the given conditions - not that that would stop them from screwing someone over I'm sure)

Their poor attitude certainly doesn't do much to make me want to help them out anymore although that was my intent. 

But since it is only certain games, from 1 provider, should I try to contact that provider instead?  It's possible I imagine that it's not just OwlGames that might possibly lose money to the issue, though I really don't know.

I guess since these are casinos, losing a couple hundred to a few players every few days that would otherwise not have won anything maybe is just a drop in the bucket.  But I found it so strange that they immediately just alerted me that they have no bounty program.  Aren't casinos supposed to be pretty protective of their money even if they have a ton of it? 

Anyone else have any experiences of trying to report issues like this?  I want to be rewarded for my time verifying the issue without taking advantage of it and alerting someone about it, too, so I'm also just worried about giving the info out and having them come up with some excuse like "oh it just needed a restart it's fine now, that's not a bug."

You are probably one of the first people that a casino has turned around to and said "yes, enjoy the free winnings from a hole in our games!". Enjoy it! Win, withdraw, win, withdraw, until you can't no more. You do have their permission at the end of the day! I certainly wouldn't pass up the opportunity 

To answer your question though, the best way to report it is to record the anomaly and detail how exactly to replicate it. Then send it to the team, or as you said, to the game provider. Whichever is most applicable.

[bitbollo]

It's the first time I've heard a casino say "take advantage of the bug".
maybe it's a "small" bug that can't have a big impact on their economy?

at this point it is certainly correct to talk to the provider of that specific game just to have a "clear conscience" and act honestly.
unfortunately there aren't many solutions in this case if they don't want to award the players and exploiting the bug I don't think is the correct solution (also because they may simply not pay you...)

[Jody.Drummer]

Either way that's a bad attitude they should at least acknowledge the report, even if they are not giving rewards at least they should be considerate enough to acknowledge, with that kind of answer they don't care because coming from their own mouth if this is true they will just not honor coming from bugs, the gambler is the one that will suffer because he thought his winning comes in playing fair, it turned out there is a bug, I want to see Owlgame answer into this allegation this is serious and gamblers will opted not to play in their platform.

While people out there exploit casino vulnerabilities to their own advantage, Op is here to help keep this bug from leaking into the wrong hands. Instead of giving gifts but reciprocity which is not so good Op accept. Although vulnerability is one of the weaknesses of casinos, they should be grateful to whistleblowers and rewarded. So far, Op may need to enjoy the benefits that have been obtained, and as long as the casino doesn't give a positive response, the solution is to try to drain it. lol

[Desmong]

Op should not bother himself on the issues since the casinos had clearly stated that they do not have any bug bounty current so op should not feel like he want to show them what they are already aware of.
This might just be something they are aware of and they allow it to keep going because it won't have so much effect on there finance.

[redsun114]

Either way that's a bad attitude they should at least acknowledge the report, even if they are not giving rewards at least they should be considerate enough to acknowledge, with that kind of answer they don't care because coming from their own mouth if this is true they will just not honor coming from bugs, the gambler is the one that will suffer because he thought his winning comes in playing fair, it turned out there is a bug, I want to see Owlgame answer into this allegation this is serious and gamblers will opted not to play in their platform.

I am thinking that what if they truly take it seriously but they only reply like that (in a joking manner/tone) only to make it not obvious that they truly care because maybe they don't want to pay anything for that user who reported the bug.

They say enjoy the bug and then by the time the guy try it out again, he will only be shocked that the bug doesn't work anymore but I think he won't get angry because that was also what he wanted to happen. He is too kind. I hope others will be like him. If only all gamblers are like this then I don't think the casino will be tough in terms of their requirements because they know that none of the gamblers will abuse it.

[Newlifebtc]

if there really is a bug in their game of course this should be a serious concern for them, but if indeed they feel it's not a bug I think you also need to provide complete evidence to give them confidence not just a screenshot or you can use it with another way to let them know, to my knowledge there aren't many casinos that provide bug bounties

I think that you are correct in this point you made but the problem is that I could not understand that the grammatical expression of your ear use of how much so please the next time I think you have to break it down for me to understand exactly what you mean at the last part of your sentence I am confused of the statement being casino provide a bug a bounty.

[btc78]

You did your task mate. You didn’t exploit the bug, you reported it to the support team, so consider your work is done. If still now owlgames’s money gets drained out from their site, then they will be the only ones who will be responsible for this. Their immature behaviour and attitudes to such reports will surely land them into some trouble. I am really impressed by you OP that in this cruel world, where people are ready to do anything for making money, you thought about the site. Yes contacting the game service provider will be the ideal decision now.

This is what I think as well, I mean the OP found a bug and instead of keeping quiet about it and taking advantage of it they decided to alert the casino about the possible consequences of this bug for them.

But for some reason it seems the casino disregarded their report and at least for now it does not seem as if they will do anything to try to correct it, in my opinion the OP has already done enough and should not feel responsible at all if another gambler finds out the bug, takes advantage of it and the casino loses a huge amount of money as a result for their negligence.

The way I view the OP statement was he reported that there is a bug in the game to the support but he didn't explain the full details after the support tell him that there's no bug bounty program to reward him. I guess the bug is still not fixed since OP will not gonna think to report it on the game provider if he already told it to Owl and they just didn't take action on it. I mean he can simply abused it if Owl knew the existence of the bug and didn't solve it.

well Bug reporting does not mean we must be rewarded but for the team/casino side? giving at least generosity for people trying to help them out is better instead of just ignoring those people effort .
Bug is really something that must be addressed and even some big site are asking for bug bounty just to help them out.

[serveria.com]

So I discovered a bug affecting a mode of play at OwlGames casinos that results in certain games rewarding more money than they should.  I tried to report it to OwlGames but was told that they have no bug bounty program and to "enjoy the bug" (not kidding).  (of course their docs say that any "exploit" can result in not being paid out, but it's not an exploit if it's simply how things run under the given conditions - not that that would stop them from screwing someone over I'm sure)

Their poor attitude certainly doesn't do much to make me want to help them out anymore although that was my intent. 

But since it is only certain games, from 1 provider, should I try to contact that provider instead?  It's possible I imagine that it's not just OwlGames that might possibly lose money to the issue, though I really don't know.

I guess since these are casinos, losing a couple hundred to a few players every few days that would otherwise not have won anything maybe is just a drop in the bucket.  But I found it so strange that they immediately just alerted me that they have no bounty program.  Aren't casinos supposed to be pretty protective of their money even if they have a ton of it? 

Anyone else have any experiences of trying to report issues like this?  I want to be rewarded for my time verifying the issue without taking advantage of it and alerting someone about it, too, so I'm also just worried about giving the info out and having them come up with some excuse like "oh it just needed a restart it's fine now, that's not a bug."

Dude, you created this forum user "owlbugreporter" with the only purpose of opening this thread? Just wow. Anyway, if you have reported this bug and their support said you're free to exploit it, so where is the issue? Just do what they said, that's not your problem anymore. It's a bit weird that they're letting you win more than you would normally without the bug. Perhaps they thought you're one of those scammers demanding bounty for fake exploit reports.

[maydna]

well Bug reporting does not mean we must be rewarded but for the team/casino side? giving at least generosity for people trying to help them out is better instead of just ignoring those people effort .
Bug is really something that must be addressed and even some big site are asking for bug bounty just to help them out.

I agree with this. At least we have tried to help them and pointed out a bug in their casino and hope they can fix it so that people do not abuse it. If the casino gives us a bounty, that's a good thing because it means they really appreciate our input and can fix bugs immediately too. But usually, if it's a big casino, they will give a reward to the person who found the bug to show gratitude.

[ultrloa]

Anyone else have any experiences of trying to report issues like this?  I want to be rewarded for my time verifying the issue without taking advantage of it and alerting someone about it, too, so I'm also just worried about giving the info out and having them come up with some excuse like "oh it just needed a restart it's fine now, that's not a bug."

Don't expect about them giving bounty to you for discovering a bug if they give then much better if not still fine but at least you help them figure out about the issue and as well you help other gamblers to make their playing experience became more convenient to them.

But if you think the bug is severe and it takes a lot of time for you to discover this then try to contact them and ask about possible reward maybe they can think about it.

[Kakmakr]

It's the first time I've heard a casino say "take advantage of the bug".
maybe it's a "small" bug that can't have a big impact on their economy?

at this point it is certainly correct to talk to the provider of that specific game just to have a "clear conscience" and act honestly.
unfortunately there aren't many solutions in this case if they don't want to award the players and exploiting the bug I don't think is the correct solution (also because they may simply not pay you...)

Well, not all "bugs" lead to losses for the casino or the provider... some losses will give an unfair advantage for players who knows how to "game" the system ....and this gives them a higher chance to win over other players. I explained in a previous post how players of Mount Magma figured out how to win the daily jackpot.... so the casino did not lose anything, because the daily jackpot payout in any way.

The thing is...... if you say your games are provably fair, then you have to make sure that everyone gambling at the casino... have the same chance to win on all the games. 

[QueenVera]

This is really strange and  you should possibly recheck it again if you haven't done so because since you've already informed them, I'm sure they might have gone to check it out without wanting it seem like a big from them or wanting you seek for a compensation from them but in the other hand their response was really strange to me and I must confess that if I was to be in your shoes, I would take a greater advantage of what was presented to me without hesitation but I'm sure that if they were in the position to take such advantage of me, they would do so even without having to inform me on ay issue or so.
But at same time I think th casino doesn't haven anything or much to loss since the casino might be provably fair but what this bug might so is just give you some winning advantage over other players.

[crwth]

Amazingly, your account was made for your post. So if interested, stick around the forum and learn more about different stuff, not just gambling but crypto in general.

Anyway, you have already done your part in reporting and contacting them. If they still didn't make a move on it, it's their loss. Good job on finding it! Can you share how you found out about it?

[aioc]

I think you should change the title of the thread that will call out Owlgame, so they come here and explain their side of the story, we don't know the real story until we hear their version but what you've posted is not good for the reputation of a casino, they just ended their signature campaign and they have one complaint that is still unresolved.
It's irresponsible especially for a casino not to fix the bug or even not acknowledge it because it will end up a more serious issue, no gamblers will want to play in a casino with bugs, as the true result will not reflect on their game.