Yesterday morning, after a long night of goombling, I decided to have a glance at the source code for roulette, I figured maybe @McCoxmaul made a little mistake that would allow to gain an edge in my goombling. Little did I know, I was about to discover a way to get free, unlimited dramacoin.
How it works
Your dramacoin is updated by checking how much dramacoin you had before, and then setting your current dramacoin to that number minus what you just spent. This would work fine, except that you can make multiple deductions at the same time using multiple threads (say your phone and pc, or two chrome tabs) . By spending twice simultaneously both threads update the value relative to the same starting balance, and since the second thread isn't aware that the balance has just been updated, it overwrites that update, meaning you just spent the same dramacoin twice.
The timing is relatively easy to pull off as python is notoriously slow so the gap between checking the balance and updating it was quite wide, so I was able to exploit this by just clicking "bet" at the same time from two devices.
@TwoLargeSnakesMating had this to say:
[It's] not a thread locking issue in particular; moreso just the way Carp got creative with using getattr/setattr on the User objects apparently doesn't create a database transaction, which should act like a mutex how you're suggesting.
Which is basically what I'm saying with some webshit lingo mixed in.
end of nerd shit
As soon as I verified the bug by printing myself 30k dramacoin in roulette I told @Aevann, and then went back to the casino, Carp was gambling too and noticed something was strange. Here are some screenshots of him being r-slurred:
Edit: Turns out Carp didn't find the exploit despite being one of the first to know there's a bug (lol).
Once the rest of the devs got wind of the bug they quickly fixed it without anyone knowing @Schizo
and carp farmed this for millions of dramacoin. Schizo went overboard by making dozens of huge bets simultaneously to farm enough money to make @getogeto the richest dramatard.
@getogeto then started sending huge sums to various users, some of them successfully laundering the money before Sneks pulled the plug. Geto was also was nice enough to give me some reparations as I was rehab awarded but before long people's dramacoin balances started resetting as we were having too much fun.
Some users probably figured it out as well. If you didn't get to greedy I doubt admins will catch you unless they have the gambling history saved and check it against current dramacoin balances.
The bug is currently being fixed while the casino is disabled. What will never be repaired, however, is my psyche after seeing this site's source.
Update: Everyone who spent their GetoBucks on awards now has negative dramacoin 
(except for me suck it poorstrags)
More drama:
never stop gambling
Jump in the discussion.
No email address required.
Conclusion: next time letβs be more discreet and nobody tell the jannies
Jump in the discussion.
No email address required.
More options
Context
Jump in the discussion.
No email address required.
More options
Context
The best form of security is of course, unintelligibility. Everyone knows this
Jump in the discussion.
No email address required.
Code obfuscation? Baby time. Verify user transactions manually using double-transaction checking chimps? Real shit.
Jump in the discussion.
No email address required.
More options
Context
More options
Context
Minor Correction, carp fell asleep right before I discovered how to actually do it lol so he didn't actually profiteer from this
Jump in the discussion.
No email address required.
He didn't even know the simple phone + pc version I used?
Jump in the discussion.
No email address required.
No what was ur version lol did u just click quickly?
Jump in the discussion.
No email address required.
yea I made like 40k just clicking "ok" at the same time in the phone and laptop. Worked like 1 out of 3 times
Jump in the discussion.
No email address required.
More options
Context
More options
Context
More options
Context
Schizocel not breaking rdrama code challenge (imposible)
Jump in the discussion.
No email address required.
More options
Context
More options
Context
Give me back my coins admin. I had 10,000 coins made from my sweat and blood before
the counter-revolutionaryGetoGeto gifted me an absurd amount of money. This is unfair and unjust taxation and as a staunch libertarian, I despise the heavy hand of the State interfering in my financial affairs.Jump in the discussion.
No email address required.
More options
Context
And to think last night I was gambling like a regular r-slur. Remember folx, it pays to be an an neurodivergent r-slur
Jump in the discussion.
No email address required.
More options
Context
I was napping when this went down and woke up to negative DC.
Oh well, I trust the Pharaoh to roll back things without too much hassle.
Jump in the discussion.
No email address required.
More options
Context
Jump in the discussion.
No email address required.
More options
Context
Jump in the discussion.
No email address required.
More options
Context
Look at that source code, im glad I flunked out of cs
Jump in the discussion.
No email address required.
More options
Context
they should have given me all the money
Jump in the discussion.
No email address required.
More options
Context
I actually spend the whole day yesteday doing this shit so i won't be online today
Jump in the discussion.
No email address required.
More options
Context
This is Aevannphobia
Rdrama is without a doubt the best thing on github. I love it so much bros
Jump in the discussion.
No email address required.
More options
Context
Jump in the discussion.
No email address required.
More options
Context
Wait hangon this sites coded in python
Jump in the discussion.
No email address required.
More options
Context
webdevs are drooling r-slurs confirmed
Jump in the discussion.
No email address required.
More options
Context
TLDR
Jump in the discussion.
No email address required.
More options
Context
The real lesson here. It makes me sick knowing I'm using a django app
Jump in the discussion.
No email address required.
More options
Context
Leave it to me for being r-slurred and do normal gambling
Jump in the discussion.
No email address required.
More options
Context
Snapshots:
https://web.archive.org/https://i.rdrama.net/images/16841302912992704.webp
https://archive.ph/?url=https://i.imgur.com/AlYNnH6_d.webp?maxwidth=9999&fidelity=high&run=1 (click to archive)
https://ghostarchive.org/search?term=https://i.imgur.com/AlYNnH6_d.webp?maxwidth=9999&fidelity=high (click to archive)
https://web.archive.org/https://i.rdrama.net/images/16841302916074662.webp
https://archive.ph/?url=https://i.imgur.com/ps0HgSt_d.webp?maxwidth=9999&fidelity=high&run=1 (click to archive)
https://ghostarchive.org/search?term=https://i.imgur.com/ps0HgSt_d.webp?maxwidth=9999&fidelity=high (click to archive)
https://web.archive.org/https://i.rdrama.net/images/1684130292028832.webp
https://archive.ph/?url=https://i.imgur.com/bUyOUnE_d.webp?maxwidth=9999&fidelity=high&run=1 (click to archive)
https://ghostarchive.org/search?term=https://i.imgur.com/bUyOUnE_d.webp?maxwidth=9999&fidelity=high (click to archive)
laundering the money:
https://web.archive.org/https://rdrama.org/h/twolargesnakesmating/post/104466/marseyraging/2727843?context=8#context
https://archive.ph/?url=https://rdrama.org/h/twolargesnakesmating/post/104466/marseyraging/2727843?context=8#context&run=1 (click to archive)
https://ghostarchive.org/search?term=https://rdrama.org/h/twolargesnakesmating/post/104466/marseyraging/2727843?context=8#context (click to archive)
source:
https://web.archive.org/https://github.com/Aevann1/rDrama/blob/frost/files/assets/js/lozad.js
https://archive.ph/?url=https://github.com/Aevann1/rDrama/blob/frost/files/assets/js/lozad.js&run=1 (click to archive)
https://ghostarchive.org/search?term=https://github.com/Aevann1/rDrama/blob/frost/files/assets/js/lozad.js (click to archive)
Jump in the discussion.
No email address required.
More options
Context
Jump in the discussion.
No email address required.
More options
Context
So dramacoin is basically becoming more and more like bitcoin?
Jump in the discussion.
No email address required.
More options
Context
It looks like sneks leveled a flat tax on all recipients of getogeto's kindness, so you'll wind up with less than you had before.
I had around 49k, without getocoins, and now I'm at 15k.
Jump in the discussion.
No email address required.
More options
Context