Into the Spiral: Butterfly Effect

Over the weekend, many players have exploited a housing bug in which items could be transferred to or taken from other people’s houses.  If you were offline at the time, or never entered your dorm or house, you were safe from robbery as long as no one else had access to it.

While it may have started off as an accident somewhere, it eventually led to an illegitimate exchange system where people made deals on “trading” pets.  This was possible since pets, as furniture items, could be placed in another’s house due to the bug.  But because this “bartering” system was underground and against the rules and Terms of Use, there was no control in place, and items gained and/or lost during the transition most likely were not recorded on an activity log.  Therefore, without security assurances, scams became even more rampant.

Ronan Dawn did some research over the weekend, and followed a pair of people to see the bug in action.  This type of show-and-tell is what malicious players did to prove that the exploit did exist, and further draw the “victim” in agreeing to a trade.  But as soon as that person gives their end of the deal, the scammer takes the pet and leaves.

Alright, so KingsIsle can remedy this very easily!  Just punish whoever sent in a complaint form (the “victim”) and the house guest (the “scammer”) via the activity logs and ban them for use of an exploit to gain an unfair advantage; they both agreed to break the rules!  But what happens when the victim is actually innocent?

It turns out that the opposite (retrieval of items) worked as well.  People were able to use the method and abuse the new function of picking up ALL items.  That means, instead of items being placed, they were taken.  So, anyone on your Friends List could potentially steal your furniture items (including gear on the mannequins and pets) if you ever stepped foot inside your dorm or house.  This includes Friends of friends.  Thus, the victim here did not even have to consent to anything, nor did they know anything was missing unless they looked.

I would rather not explain how the bug works or how it is performed, specifically, but I have a strong feeling that the steps involved do not write anything to the activity logs.

Let’s say that that’s true.  Without any record or way of tracing items back to people when they are given, received, or stolen, the Company will be left in a fog of emails and complaints, where some are true and some are questionable.  The issue is verifying which is which.  Put yourself in KI’s shoes.  How would you effectively replace the items your customers worked so hard to farm for (furniture, pets) or craft (Carousel, Mannequins, Portraits of Greyrose/Ambrose) if you do not have any verification that the item is missing?  If there are tens of thousands of these arbitrary reports (keep in mind, that’s a small number compared to ten million, but nevertheless tens of thousands more than necessary), will you actually go to each person’s residence, communicate with them, and return the specific items back?  Oh, keep in mind, your inbox is full of other unsolved anomalies, with just as much priority as this.  From what I’ve last heard from Ian, she and the Support crew are still managing individual accounts that are believed to be missing Crown items (relation to the Firebat/Crowns compensation).  Now they have this on their hands too…

So, what’s the first move you’re going to make, as KI?  Well, to put a stop to the growing inbox, let’s cut off the access to recreating this bug.  Hence the [temporary block on housing, earlier today].  Next, we’re going to terminate it.  Now that people are temporarily evicted, we can start fixing the codes and prevent future occurances.  We’re pretty sure Witches and Wizards want to grab their pets or gear that they left in their homes today, so we’ve gotta open access again.  Great, the future of the Spiral has been saved.  Now for the past…

Many people have had their wallpapers and tiling stolen and sold to the auction.  Some of them may be detail-specific or skilled interior designers who happened to have rare patterns, but now everything is missing.  How do we account for every single person?  How do we know that our players did not use other loopholes, such as creating a new account, transferring items to that fake Wizard, and transferring it to their actual alternative, and are now claiming that someone stole their items?  Or perhaps send No Trade items through the mannequin, such as arena gear, to a Level 1, 5, or 10 character?

Let’s turn back time to before all this happened.

I haven’t heard anything from KingsIsle, but this is a global consequence that I fear the most:  Character reset.  This would definitely make the victims happy to have their pets back, with the same name, same abilities, and same stats; there’s no need to train up a replacement FOG Unicorn for the one you had placed in your Home Collection of Epic pets.  Plus, some Mega Snacks that went into that thing long, long ago, way before this bug was discovered, are not wasted money.  But how do you find the individual thieves?  People redecorated their house over the weekend, so we can’t look at just the logs for usage of “Pick All Items Up.”  What about someone who managed to make it off with only a few items due to a full backpack, bank, and attic?  Looking at large quantities of inventory movement may find a lot of violators, but it doesn’t fix them all.

Keep in mind, this is just my logical guess; it doesn’t mean that KingsIsle will necessarily do that.  Still, I can’t help but grimace at the fact that all our hours of reagent sniping and farming over the 3-day weekend may disappear off the records.  That’s not even counting the Pet Training or farming.  But, alas, that’s the smoothest way to fix what naughty students have done.  When we do one little thing that benefits us that goes beyond the game’s intentions, it always has the potential to affect the entire Spiral.  So, before you even think about using any bug to your advantage, consider that this may be a double-edged sword; it’s much better off reporting it before everyone gets hurt.