Credit transfer anonymity bug: what happened

On Wednesday night we added a "Transfers between you and X" panel to player profiles, showing the cash and credit history between your current character and the character whose profile you are viewing.

It had a bug. If somebody had sent you credits anonymously, that transfer was listed in your Credits tab with their name on it. The entire point of an anonymous transfer is that you do not learn who sent it, and for just over 24 hours, some people could.

It is fixed. Below is what caused it, how we worked out who it reached, and the exact numbers.

HOW LONG IT WAS LIVE

  Panel went live   Wednesday 23 September, 11:24:56 PM EDT
  Fix went live     Thursday 24 September, 11:35:31 PM EDT
  Total             24 hours, 10 minutes, 35 seconds

WHAT CAUSED IT

Credit activity is recorded in a log where every entry carries a type number. A normal incoming transfer is type 7 and displays the sender's name. An anonymous incoming transfer is type 41 and displays "An anonymous benefactor".

Both entries store identical data, including the sender's name and ID in plain text. The only thing that makes one anonymous is the type number, which picks which sentence you are shown.

When the panel was built, the list of types to display was assembled from the human readable labels in that table. Three of the four anonymous types are labelled with the word "anon". The fourth, type 41, is labelled "transfer gift recipient", which reads like an ordinary gift. It was included by mistake, and because the stored data contains the sender in plain text, the panel matched it and printed the name.

HOW WE FOUND OUT WHO WAS AFFECTED

No single source could answer this, so we used three.

1. The game's own page log records which character made each request, but it never recorded this panel at all, because the panel skips the page template that writes that log. Its count was zero, and that zero proved  nothing.

2. The web server log recorded every request, but knows only IP addresses, not characters. Our first attempt read the wrong log file and produced a confident zero. We caught it by comparing against a figure we already knew: it claimed 108 profile views for a period in which the game itself had recorded 22,297.

3. The two were joined using the profile view. The panel can only be opened from a profile page, and every request carried that page as its referrer, so the profile view immediately preceding each panel request identifies the viewer.

Where that still left more than one possible viewer, the size of the server's response settled it. An empty result is 90 to 104 bytes. Anything 150 bytes or larger contained rows. In each case only one candidate had any credit history with that person at all.

As a control, a request that should have returned nothing came back at 92 bytes. That is what makes the method trustworthy rather than merely plausible. 

We also confirmed the web server had logged everything, by checking it against the game's own count for the same period. It had recorded 27,487 profile requests against the game's 22,297, so nothing went unlogged and the figures below are totals rather than minimums.

THE NUMBERS

  2,405   anonymous credit transfers exist, going back to 1 January 2022
  1,127   characters across 426 accounts had received at least one, and were therefore potentially exposed
    397   requests were made to the panel while the bug was live
    105   of those reached the Credits tab, the only place the bug could appear, since the panel opens on Cash
      3   of those 105 actually displayed an anonymous sender
      1   of those 3 was our own test during the investigation

So two players saw the name of somebody who had sent them credits anonymously. Both have been identified. No sender's identity was exposed to anybody else, and nothing was exposed publicly.

THE CASH SIDE WAS NEVER AFFECTED

Anonymous cash transfers work by a different mechanism. They carry a dedicated flag on the transfer record itself, and the panel filtered on it correctly from the moment it went live. Every anonymous cash transfer in the game's history was tested from both directions: the recipient cannot see it, the sender still can. A normal transfer was tested alongside them to confirm the filter was not simply hiding everything.

WHAT IS FIXED

Type 41 is no longer selected, and a second guard now blocks all three recipient blind types even if that list is ever edited again. Both were checked against live data after deployment, including against an anonymous transfer made after the fix shipped, which correctly showed nothing.

We are sorry. Anonymity is something you chose, and for a day it did not hold.