Spoofing Matrix Solutions


#1

When saving a system, you can also include an solution.
The solution has a solver field which takes a ID and is not checked against the sessionid.
Since IDs are numeric, you can forge a solution from any player which then shows up in the Friends' Solutions section.
https://exploitzeroday.com/system/0dZR4d/

Also, since they are registered as valid solutions, who would the scrypt be given to since the solver and session are different?


Update to 0.24.8
#2

We've hotfixed this issue. Thank you very much for reporting it!

Solution rewards are not considered in this situation (since you should only be able to create your own solutions, and you're updating your own system), so no scryp was awarded for any spoofed solutions and spoofed solutions should not affect future rewards.