Dice Game Nonce Skip Incident
Disclosure and Technical Report
Dice Game Nonce Skip Incident
Discovery
On 25 Jan 2024, we received a report from a user about what we initially believed was a visual bug displaying an incorrectly incremented nonce for a dice roll. After an investigation of their account, we were able to confirm that two nonces had indeed been erroneously skipped, and we launched an investigation into the matter.
We were able to narrow down the bug to a faulty function getActiveSeed which was part of a security update pushed in December 2023. getActiveSeed increments the nonce while fetching the active seed in order to prevent the roll’s outcome from being predicted. If the function resulted in an error and was unable to proceed, the function’s changes would be rolled back. However, an oversight in the code led to the user’s nonce still being incremented when such a roll back occurred. This means in some rare cases where the getActiveSeed function resulted in an error, one nonce would be skipped. The reason for this is mainly due to a user temporarily not having enough funds for the transaction to go through while auto-betting or having multiple browser windows open.
Investigation
After receiving the report we conducted a detailed investigation into all bets that had been affected by the bug. We discovered that 161,214 out of 20,038,866 bets (0.8%) had incorrectly skipped a nonce.
Looking at all cases we confirmed that while the bug changed the outcome of a roll in practice, it did not affect the odds or randomness of the game — it simply created a result different to the one the user would have originally received. The bug is hence EV-neutral, in the sense that it did not create any expected losses or expected gains for users. However, it affected our provably fair system, as users were unable to verify if the nonce had been skipped as a result of a bug or intentionally to make the user lose. At Gamdom, one of the things we pride ourselves on is our commitment to provably fair gaming, so we made the decision to reimburse users for any losses suffered.
Our methodology for reimbursement was as follows:
- For each affected user, we added up the outcomes for all bets affected by the bug. For example, if a user had two dice rolls affected by the bug, incorrectly winning $1,000 on one and incorrectly losing $800 on the other, the total outcome would be +$200.
- For users that incorrectly made profit from the bug, we took no action.
- For users that incorrectly made losses from the bug, we provided a full reimbursement of the total loss amount from all incorrect outcomes summed up.
As of the publication of this report, all affected users have been reimbursed in full. The total amount we refunded to users is $104,124.11. We have attached a full report outlining all of the affected bets and also a report of total outcome of compensations per user as an appendix to this document so that our results can be inspected.
Solution
The getActiveSeed function error was caused either by a user temporarily not having enough funds to place a bet, due to simultaneously betting on multiple games, and due to peak loads on our server side. We restructured the query to be more efficient and moved the balance deduction part of the query before getting the active seed. This will result in there being little to no transaction rollbacks. We also included nonce reversion, which means that in the event of an error, the nonce will correctly be rolled back instead of being skipped. The update has been rigorously tested and the bug has been completely fixed. The fix was pushed to our servers on Jan 27 2024 at 19:14 UTC.
Summary & Conclusion
- We discovered a bug in Dice that caused 0.8% of bets to skip a nonce.
- While this bug did not affect odds and was EV-neutral for the player, it affected players’ ability to verify roll outcomes via our provably fair system.
- Users that profited from the bug will have no change or rollbacks.
- We identified the problematic code and implemented a full patch on January 27.
- Users that lost money to the bug have been reimbursed for their losses in full on January 30.
Special Thanks
Special thanks to Mihai and the PFF (Provably Fair Foundation) for reporting the issue.
Appendix
