[High] [Bug] spendRawMana/spendElementMana accept negative amounts — unlimited mana exploit #358
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Severity: High
File:
src/lib/game/stores/manaStore.ts(lines 76-80, 116-122)Description:
spendRawManachecksif (state.rawMana < amount) return falseand then doesstate.rawMana - amount. Ifamountis negative, the check passes (sincerawMana >= 0 > amount) and subtracting a negative adds mana with no cap — nomaxManacheck.Similarly,
spendElementManachecksif (elem.current < amount)— ifamountis negative, this check always passes, andelem.current - amountadds mana to the element with no cap.Impact: Exploit — passing a negative spend amount would add unlimited raw mana or element mana. If any UI or code path allows negative values (e.g., through crafted input, debug tools, or save editing), players can generate infinite mana.
Fix needed: Add validation that
amount >= 0at the start of both functions, throwing an error or returning false for negative values.Starting work on fixing the spendRawMana/spendElementMana negative amount exploit. Will add validation to reject negative amounts.
Fixed. Added negative amount validation to spendRawMana, spendElementMana, addRawMana, addElementMana, and unlockElement in manaStore.ts. All 1157 tests pass.