15

Steps to follow:

A. Just open a question which has some answers in it.

B. Target anyone random answer from it.

C. Now inspect its downvote button. it should have a class named vote-down-off

enter image description here

D. Now remove that class from it and add some other id/class of your own wish.

enter image description here

E. Now open the console and type the following code and just press enter key.

for(var i=0; i<100; i++){ $('#test').trigger('click'); }

Note:

  • In $('#test') part, you have to replace the 'test' with your id.
  • don't increase the count(i<100) more than this, because the system would realise that the requests which made are not a humanly possible one, so that it would temporarily block the access to your ip.
  • Additionally the reps would also be added to the user who belongs to the answer that you selected in step B.

Outcome:

May be the page get frozen for some seconds. when page comes to the normal stage your account would be added with some reps. [Note: The reps which will be added are not a constant one. it depends on how the system confuses at the particular moment, because of the async calls.]

A message to the dev team:

Its my duty to bring the bug before you soon. I just found it before 1 hour I guess.

While removing the class, there is some sort of logical break down is happening with binding and unbinding events. please fix it soon.

And while testing this bug I have earned some 75 - 100 reps(I am not sure) in this way. additionally the I just used the following user's answers sudhar and johan for testing the bug as a consequence they also had earned some reps in this way. sudhar [100 - 150 reps] johan [40 - 50 reps].

and I don't want those reps which was earned in dirty ways. please take them back and please bring back my account to the normal stage.

18
  • 17
    I think you need to learn about "ethical hacking". TLDR: do not post this publicly until it's patched.
    – HamZa
    Commented Apr 26, 2014 at 20:03
  • 5
    @HamZa but everybody are posting the bugs they found through meta right.? Commented Apr 26, 2014 at 20:04
  • 19
    The only bug here might be cache contention, otherwise you're just repeatedly creating and removing a downvote, any rep recalc would correct any discrepancy. Commented Apr 26, 2014 at 20:06
  • 1
  • 9
    @RajaprabhuAravindasamy bugs like "logo off by 2 pixels" sure. bugs like "here's how to hack our system and steal all the monies" hell no, use common sense. Wouldn't it have been awesome if heartbleed was publicized and the media was reporting on the openssl teams work in coming up with a patch for the first 2 days?
    – djechlin
    Commented Apr 26, 2014 at 20:49
  • 2
    It's just "breaking the game" rather than exposing personal data etc so I think it's fair enough out in the open like this Commented Apr 26, 2014 at 20:50
  • @djechlin hey sorry.. I thought posting on meta would be helpful on fixing this kind of serious bugs soon. and if I sent this to SO support team, what if they treated this one is very similar to the other unreadable mails..? Commented Apr 26, 2014 at 20:58
  • 1
    They won't, they handle security issues rather seriously. Though in this case it's not so major (given that the change is temporary) so we don't have to worry. Commented Apr 26, 2014 at 21:05
  • 3
    Yeah, we push security issues on to the dev team rather quickly (unless they're "when I type malicious code into my browser, my browser executes malicious code"). See Nick's answer for why posting this publicly isn't a huge deal though.
    – Shog9
    Commented Apr 26, 2014 at 21:11
  • 4
    Maybe a good moment to tone down the title?
    – rene
    Commented Apr 26, 2014 at 21:13
  • 1
    So you'll also call this a bug? It's just design issue, no different than the powers granted by Unicoins 26 days ago. Commented Apr 26, 2014 at 21:15
  • @ShadowWizard no, in this case one can actually receive privileges through this. Temporary, though. Commented Apr 26, 2014 at 21:16
  • 3
    @shog9 Did you guys just put any ip ban on me..? I love so more than another sites on the Web.. I was just tried to do a good thing.. Isn't? Is this the reward for that...? Commented Apr 26, 2014 at 21:20
  • 1
    @RajaprabhuAravindasamy The ip ban is automatic. It goes away in a few minutes. Commented Apr 26, 2014 at 21:26
  • 6
    @RajaprabhuAravindasamy thanks for posting this. Really does anybody care if there are temporary "powers granted"? Stop harassing the man. Commented Apr 26, 2014 at 23:09

2 Answers 2

41

This isn't really a serious bug - it's a tradeoff we made in speed vs. accuracy in the voting system and a race condition that exists in the reputation calculation. When many requests at once happen and a commit hasn't happened from the first, a race can happen on the differential.

What this doesn't do is give you reputation for more than 24 hours - the RepHistory table is compared to current totals for every user every day. Those who don't match get hit with a recalc. If this turns into an actual problem with users abusing it, then we'll log those who are obviously exploiting and take appropriate action on them. I already triggered a recalc on you via the same mechanism to demonstrate this working.

There are other fixes we can perform, but we prefer not to due to cost of locking the transaction. This minority, temporary case isn't worth the tradeoffs for the other 99.999% of vote requests.

If you're considering exploiting this, lets just say strongly I recommend against it.

3
  • 3
    Theoretically, how much temporary rep could a user gain/lose from this (gain a Max of 200 i would guess)? (Just out of curiosity, I don't plan on doing/using it)
    – Howli
    Commented Apr 27, 2014 at 1:16
  • 1
    @Howlin there's no set limit, it depends on a number of combined factors, with latency in the race with current transaction load being the actual window factors.
    – Nick Craver Mod
    Commented Apr 27, 2014 at 16:33
  • 5
    @NickCraver And what if the user earns a badge meanwhile? Would it be taken back just like the rep recalc? Commented May 6, 2015 at 5:42
13

This "bug" isn't permanent.

This will be cleared on the next recalc, and since recalcs are done rather often, this isn't much of an issue. The system is designed so that there can only be one vote per post in the table. What you're seeing is the cached reputation, which is stored as a part of the users table to avoid excessively heavy JOINs.

However, one can possibly gain a privilege by throttling the script and applying it, though I don't think that the rep gained will be more than 200 before the recalc starts.

It's a race condition, really, the system is not noticing that a downvote has been placed and is internally triggering the downvote event again.

It might be worthwhile to trigger a recalc in the case of a rapid flurry of unupvoting/undownvoting.

4
  • 1
    No need to put "bug" in quotes - it's a real actual honest bug, even if the question is phrased a little funnily ;)
    – mafu
    Commented Apr 26, 2014 at 21:47
  • 1
    @mafu it's actually by design here, see the answer above. Commented Apr 26, 2014 at 21:53
  • 6
    A bug by design is still a bug :)
    – mafu
    Commented Apr 26, 2014 at 22:03
  • 9
    @mafu No, it's a feature! ;)
    – Seth
    Commented Apr 26, 2014 at 23:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .