Mousehunt exploit was found and fixed

March 07, 2017 | Blog

If you notice Mousehunt was down for maintenance on 7 March 2017, here is why.

A hacker exploits a bug in the Mousehunt system.

The exploit allows him to generate as many golds as he wants.


A player found this at 12:52pm AEST




13:07pm:

The effect is that the items in the marketplace are mostly purchased by him, including TSP and EOD.

Players start having massive chat discussion in a Mousehunt group: Royal Mousehunter Force [RMF]


15:57pm: The exploit has been handled by the dev. 

By the way, he banned all accounts that were trading gold in mass quantities.

"Only bans were given out to those obviously exploiting. e. g. 1 Moon Cheese listed for 999,999,999 gold." - the dev


I hope you are not included in the banning spree.

A bit unfortunate that this happens during Mousehunt birthday event.


Update from the dev:


"We haven't performed a rollback in years and it's not a light decision to make. It would affect the entire game and our Redis instances would be out of sync... It would be disastrous."


"There's no need for a rollback and any remaining offenders will be eventually dealt with. I'd rather bring the game back online now with the exploit patched to minimize disruptions."


With this in mind, therefore there will be no rollback, and the items will be returned.


16:25pm: Mousehunt is back online.

The exploiters have been banned.

"The account that performed the exploit moved quickly to move the money around, so they targeted their friends in order to spread the gold." - dev


The aftermath


"Main account that generated something like 10+ billion gold and then bought single items priced extremely high on the marketplace has been banned, along with those users who posted."

The exploiters are banned

Several players who intentionally sell items to the exploiters are also banned. if you get stockaded and believe that you are innocent, the appeal is at the top right corner of the game "Help > Contact Us"


"Hindsight, might be time to add some market caps for items and/or expiration dates on (marketplace) listings." - dev

Planned new marketplace feature in the future


"Yeah, we have all transactional data on marketplace and can do some digging tomorrow. There's no real time sensitive aspect because the paper trail can be followed, so we can eventually work through it to shut down those accounts and return items."

Marketplace and gifting are unavailable with no ETA on the re-opening



This saga has finally closed its curtain


RIP to the Mousehunt accounts of the exploiters.
King's stockade has new citizens