bug
new
2x Fatal flaws
Toruna
2026-06-02 21:35
The first fatal flaw in match design I have come across allows you to beat the same bot upwards of 25 times in a row, even though it's supposed to be dead.
Tutorial:
Go to the PvE Arena and select any bot of your liking > Start a match with them. > To back to the PvE Arena > Repeat 25 times > Go to your Notification Tab at the bottom an join the matches you started one at a time against the same bot > despite the bot should have been dead after the first, all of the other instances are considered seperate matches, and so you can keep doing it, and only need to wait for the bot to revive after the last time you killed it.
The second flaw is that; if you and another user fought each other, and one is outright killed. The living user can't challenge the dead user, but the dead user can still challenge the living user, and the two can then fight again, even though one of them is supposed to be dead.
- - - On a second note; winning over another User yields 3x more EXP than the most dangerous Bot. This is incredibly busted if you want to level an alt account quickly.
Tutorial:
Go to the PvE Arena and select any bot of your liking > Start a match with them. > To back to the PvE Arena > Repeat 25 times > Go to your Notification Tab at the bottom an join the matches you started one at a time against the same bot > despite the bot should have been dead after the first, all of the other instances are considered seperate matches, and so you can keep doing it, and only need to wait for the bot to revive after the last time you killed it.
The second flaw is that; if you and another user fought each other, and one is outright killed. The living user can't challenge the dead user, but the dead user can still challenge the living user, and the two can then fight again, even though one of them is supposed to be dead.
- - - On a second note; winning over another User yields 3x more EXP than the most dangerous Bot. This is incredibly busted if you want to level an alt account quickly.
Comments (3)
Wrecksler
2026-06-03 12:32
Yes, I know about the first one, but I'm not sure if there's anything I can or should do about it. I could lock the bot when someone starts fighting them, but that causes other issues.
Another solution is to only allow 1 active match against a specific both per player, but that also can cause issues if a room bugs out for some reason.
The second flaw... interesting.
And protecting against playing against your own alts is not something I want to even bother trying to fight. It's a losing battle on my end. There's no reliable way to detect it that will not make life worse for other players.
So I'm open to suggestions on what to do about these.
But at the end of the day, all of these systems are more about having fun than real tournaments and competitions. I mean I can see someone plays against another player and just surrenders against them all the time :)
Sigh... I guess I can think of a few ways to approach these:
1. Designing a system in a way that prevents such abuse at the core. Like locking the PVE character once anyone starts a fight with them. First one is just no. It will ruin it for others.
But only allowing 1 active match against that pve character (or 1 active pve match in general...). sounds sounds doable and fair, but has a flaw that if a room locks up for some reason (like AI narrator failing to generate a response and not advancing the fight) - user cant enter any other pve matches. But it sounds like it's a solvable issue.
For playign against yourself it's hard to come up with a system like this though. Not allowing to surrender - ok they wll just click through buttons and actions. Not allowing to fight without making posts - they can just copy paste lorem ipsum.
One approach could be to have an AI scribe analyse the match at the end to determine if it was a real elaborate roleplay with actual posts and messages, or if it was just a match where someone clicks through actions. And not paying out anything if it decides it was the former. That's kinda doable... but has downsides as well.
2. Another approach is anti-cheat system. A separate system that can track matches and detect if 2 characters are fighting each other too often, and doing little moves, and building up some kind of 'cheater score' and if it reaches a threshold - temporary ban the account. Sounds harsh and at this stage of the project - it will just make testing it harder.
3. Just not do anything about it. Let people have fun and meta game however they want. Just accept that it's less about a 100% fair competitive fun, but more about the sandbox.
Another solution is to only allow 1 active match against a specific both per player, but that also can cause issues if a room bugs out for some reason.
The second flaw... interesting.
And protecting against playing against your own alts is not something I want to even bother trying to fight. It's a losing battle on my end. There's no reliable way to detect it that will not make life worse for other players.
So I'm open to suggestions on what to do about these.
But at the end of the day, all of these systems are more about having fun than real tournaments and competitions. I mean I can see someone plays against another player and just surrenders against them all the time :)
Sigh... I guess I can think of a few ways to approach these:
1. Designing a system in a way that prevents such abuse at the core. Like locking the PVE character once anyone starts a fight with them. First one is just no. It will ruin it for others.
But only allowing 1 active match against that pve character (or 1 active pve match in general...). sounds sounds doable and fair, but has a flaw that if a room locks up for some reason (like AI narrator failing to generate a response and not advancing the fight) - user cant enter any other pve matches. But it sounds like it's a solvable issue.
For playign against yourself it's hard to come up with a system like this though. Not allowing to surrender - ok they wll just click through buttons and actions. Not allowing to fight without making posts - they can just copy paste lorem ipsum.
One approach could be to have an AI scribe analyse the match at the end to determine if it was a real elaborate roleplay with actual posts and messages, or if it was just a match where someone clicks through actions. And not paying out anything if it decides it was the former. That's kinda doable... but has downsides as well.
2. Another approach is anti-cheat system. A separate system that can track matches and detect if 2 characters are fighting each other too often, and doing little moves, and building up some kind of 'cheater score' and if it reaches a threshold - temporary ban the account. Sounds harsh and at this stage of the project - it will just make testing it harder.
3. Just not do anything about it. Let people have fun and meta game however they want. Just accept that it's less about a 100% fair competitive fun, but more about the sandbox.
Toruna
2026-06-04 16:07
**Here are my proposed solutions:**
For infinitely beating dead bots:
Idea 1:
Assign users and PvE bots a permanent unchangable token. and assign active fighting rooms a token. - The system checks to see if your token is currently in a in a match, when you try and boot up a new match. - Your token is removed from the room when a winner as been assigned to it.
- Rooms such as the tavern er exempt, as they are primarily just for chatting.
- If you ever leave the fight tab mid game, there should be a button in the menu where you can enter the active fight tab again.
- - -
For farming your own profiles for ELO, EXP and Chits:
Idea 1:
You can definitely retrieve the users IP-Address, and check that against being logged in from two or more places at once, hereby denying you entry.
- A VPN can in theory circumvent this issue, but it's more about inconveniencing the user so much that the extra effort won't be worth it.
Idea 2:
Alternatively you can only fight the same user once every 1-3 hours or so. You're meant to roleplay your matches anyways, so we should work against the meta-philosorphy of mindlessly using attacks and ending turns and over again.
- You know, this system might also prevent users from farming the PvE bots now that I think about it. o.o
For infinitely beating dead bots:
Idea 1:
Assign users and PvE bots a permanent unchangable token. and assign active fighting rooms a token. - The system checks to see if your token is currently in a in a match, when you try and boot up a new match. - Your token is removed from the room when a winner as been assigned to it.
- Rooms such as the tavern er exempt, as they are primarily just for chatting.
- If you ever leave the fight tab mid game, there should be a button in the menu where you can enter the active fight tab again.
- - -
For farming your own profiles for ELO, EXP and Chits:
Idea 1:
You can definitely retrieve the users IP-Address, and check that against being logged in from two or more places at once, hereby denying you entry.
- A VPN can in theory circumvent this issue, but it's more about inconveniencing the user so much that the extra effort won't be worth it.
Idea 2:
Alternatively you can only fight the same user once every 1-3 hours or so. You're meant to roleplay your matches anyways, so we should work against the meta-philosorphy of mindlessly using attacks and ending turns and over again.
- You know, this system might also prevent users from farming the PvE bots now that I think about it. o.o
Wrecksler
2026-06-16 07:26
Well, unfortunately it is very fragile and prone to collateral damage in reality.
Idea 1:
If a fight gets stuck user will be permanently unable to enter any other fights until admin intervention. Or there will have to be some kind of "unstuck" functionality added. Btw, you can already get back to any of your past fight rooms - they are listed on main page. UI UX should be improved though.
Restricting a character to only being in 1 pve room at a time is trivial. Restricting a "player" is not.
Idea 1 (2): We're already getting IP addresses (not keeping them, btw, just the hashes for added privacy) but this is incredibly fragile and prone to collateral. There are not enough IPv4 addresses on the planet to cover every device (thats what IPv6 is for but it's adoption even in 2026 is low). So majority of people is behind some kind of NAT\CGNAT, sharing the same IP. When you are on your phone - you don't have a unique IP. Dozens and hundreeds of other phones can be using the same IP. Same for home residential networks, by default in most places unless you specifically request a dedicated IP and pay for it you will share IP with many other people (and "static" IP is a whole other topic which is not available from all ISPs, and usually costs extra as well).
Typically this is where big companies rely on a lot more data sources to 'fingerprint' user devices - hidden "pixel" images that phone home when opened, session cookies, browser and device info, etc. But all of this layer is gone the moment you install any other browser than Chrome or Edge. Even vanilla Firefox blocks many of these trackers by default, and when it comes to Brave or Librewolf - all of that is gone too.
So I just see it as a losing battle. It will require too many resources to build something that is inherently unreliable anyway.
---
Idea 2:
This is a mindset that is closer to mine though. And in fact we already have a system that penalizes players who fight the same opponent repeatedly by reducing the amount of Chits, XP and Elo. Currently you should be getting 100% for the first match, 50% for the second and 0% for the third match, and it resets daily.
For now I think this should be sufficient.
And if it does not work please let me know, I did not have an opportunity to run extensive tests on whether it works as intended or not.
The "once every 1-3 hours" is imo a bit too restrictive. While it's not very common for real players (not alts) to engage in a second RP without any breaks - it does happen, so it would be too restrictive.
Another system I considered is some form of encouraging actually roleplaying instead of clicking through moves. But I don't see a reliable way to do it. For example if we just check if text messages with some text are exchanged - players can just copy paste some boilerplate, lorem ipsum, to circumvent that. We could have an AI model doing a verification pass before giving out rewards, but that's yet another API call \ LLM inference requirement and it may backfire as well if it does not work properly. And it can still be circumvented by copy pasting.
Bots are currently balanced in a way that you're not getting as much XP or Chits from them anyway, however a similar system of diminishing returns could be added for pve matches as well, but then we'd need to bump the rewards you get from bots.
Idea 1:
If a fight gets stuck user will be permanently unable to enter any other fights until admin intervention. Or there will have to be some kind of "unstuck" functionality added. Btw, you can already get back to any of your past fight rooms - they are listed on main page. UI UX should be improved though.
Restricting a character to only being in 1 pve room at a time is trivial. Restricting a "player" is not.
Idea 1 (2): We're already getting IP addresses (not keeping them, btw, just the hashes for added privacy) but this is incredibly fragile and prone to collateral. There are not enough IPv4 addresses on the planet to cover every device (thats what IPv6 is for but it's adoption even in 2026 is low). So majority of people is behind some kind of NAT\CGNAT, sharing the same IP. When you are on your phone - you don't have a unique IP. Dozens and hundreeds of other phones can be using the same IP. Same for home residential networks, by default in most places unless you specifically request a dedicated IP and pay for it you will share IP with many other people (and "static" IP is a whole other topic which is not available from all ISPs, and usually costs extra as well).
Typically this is where big companies rely on a lot more data sources to 'fingerprint' user devices - hidden "pixel" images that phone home when opened, session cookies, browser and device info, etc. But all of this layer is gone the moment you install any other browser than Chrome or Edge. Even vanilla Firefox blocks many of these trackers by default, and when it comes to Brave or Librewolf - all of that is gone too.
So I just see it as a losing battle. It will require too many resources to build something that is inherently unreliable anyway.
---
Idea 2:
This is a mindset that is closer to mine though. And in fact we already have a system that penalizes players who fight the same opponent repeatedly by reducing the amount of Chits, XP and Elo. Currently you should be getting 100% for the first match, 50% for the second and 0% for the third match, and it resets daily.
For now I think this should be sufficient.
And if it does not work please let me know, I did not have an opportunity to run extensive tests on whether it works as intended or not.
The "once every 1-3 hours" is imo a bit too restrictive. While it's not very common for real players (not alts) to engage in a second RP without any breaks - it does happen, so it would be too restrictive.
Another system I considered is some form of encouraging actually roleplaying instead of clicking through moves. But I don't see a reliable way to do it. For example if we just check if text messages with some text are exchanged - players can just copy paste some boilerplate, lorem ipsum, to circumvent that. We could have an AI model doing a verification pass before giving out rewards, but that's yet another API call \ LLM inference requirement and it may backfire as well if it does not work properly. And it can still be circumvented by copy pasting.
Bots are currently balanced in a way that you're not getting as much XP or Chits from them anyway, however a similar system of diminishing returns could be added for pve matches as well, but then we'd need to bump the rewards you get from bots.
Log in to comment.