EpicDice is compromised

EpicDice is an open-source gaming platform built on top of Steem blockchain with absolute transparency and fairness. Join the most epic fun today!

https://epicdice.io/

Let’s start this post with a brief announcement we made in Discord not long ago

The bad news is, after some in-depth investigation we concluded our game is exploited due to we are using the simplest provably-fair mechanism. All the game result is solely relying on the blockchain transaction ID. We thought it was random and hard enough for bad actors to game the system but apparently, it wasn’t. We will have to halt the platform until a new mechanism is being implemented, and this is going to be the team’s top priority now.

The good news is, the house fund wasn’t completely drained so we are ready to come back strong as soon as the system is patched. And for those who previously suspect EpicDice is not playing fair, this is the best(or worst) example to prove our claim: Absolute fairness. Even in such an event where the randomness of transaction ID is exploited, house is on the vulnerable side. We were truly running the best gambling service in term of everything we can.

Timeline of event

• UTC 28, Aug, 10:04: Hive account@mys started “above 99” attack against Hive account@epicdice and managed to score rolled number 100 in a long streak(27 in total). It worked by sending in 1.02 STEEM as wager with prediction “above 99” and won away 100 STEEM every hand.

• UTC 28, Aug, 11:17:
  User Hive account@selce-n and Hive account@thegoliath reported abnormal betting behaviour of Hive account@mys via blog comment and Discord channel.

• UTC 28, Aug, 11:35: EpicDice was shutdown upon a clear sign of system vulnerability exploitation.

• UTC 28, Aug, 17:04: EpicDice announced the system is being gamed due to its randomness generation which is purely relying on Steam pseudorandom transaction ID.

• UTC 28, Aug, 18:31:
  Witness Hive account@themarkymark made a post reporting the incident and confirmed that 2,698.921 STEEM has been taken away by Hive account@mys.

• UTC 28, Aug, 21:58:
  It turns out Hive account@mys is a Steem witness himself who followed up the incident with a detailed explanation of how the exploitation been done in this post.

• UTC 29, Aug, 07:29: Hive account@mys returned the full fund from the exploitation after getting in touch with EpicDice representative.

Black hat? White hat?

EpicDice would not take a side on this topic regarding what is the real intention of Hive account@mys in this attack, but choose to lay the plain facts straight and let the crowd makes the call.

We would not speak highly of him since the cold hard fact is that his exploitation was stopped by other’s alarm and he showed no intention of stopping until the system was halted. We also will not put unnecessary blame since he did the right thing by returning all fund at last.

As much as Hive account@mys was trying to make it looks like a white-hat attempt in our private interaction, it was disheartening to see someone who represents our beloved blockchain did this to a hardworking business without prior information to the team. We wouldn't not be sure if this can be a much worse situation. But certainly it would have been ended in a much better way by keeping us in the loop from the beginning.

We, however, would like to thank Hive account@mys in showing us the greatest vulnerability in the system so that we can grow stronger from here. Nothing lost, nothing gained!

Reward time

2m EPC to each Hive account@selce-n and Hive account@thegoliath for reporting the incident at earliest timing. 2m EPC to our Mr.Genius Hive account@mys for such a clever exploit deserves every bit of it from white-hat perspective.

Verdict

Like what we have stated, this is far from being the end for EpicDice. Instead, we take this as a rare opportunity to better our platform and treat such challenge as a touchstone to the team’s competency staying afloat and above no matter what is falling upon us.

We were on a mood roller-coaster the moment we found out it was a witness who did it to us. What comes to our great relief is that the tremendous support from the exact community we love all along. That was the greatest reason we chose to start our business right here on Steem, after all.

Be right back, soon.

We are recruiting

We are still looking for awesome moderator talent from the Korean and Japanese community. The requirements will be the same as here and we will leave the recruitment open until the position is filled with capable soul. Recommend yourself if you are up to the interesting role, or refer us a potential candidate. We have a little surprise for each successful referral!

Earn EPC via delegation

EPC is the only token to earn from the daily dividend and prize pool in STEEM. Every 1 SP delegation earns 2 EPC daily. It takes one day for the delegation to be effective in order to receive the dividend from the moment of delegation.

100 SP | 500 SP | 1000 SP | 5000 SP | 10000 SP

_{Disclaimer and Important Notice: Epicdice.io reserves the right, at its discretion, to change, modify, add, or remove portions of the Terms and Rules at any time without notice.}