Hacking the Degen Islands Demo

This is a re-post of an article previously posted on my personal site on 2022/04/03. The web-demo, and indeed entire project, that this article was poking at no longer exists. This is normal for the cryptocurrency space, which is so used to projects being abandoned after fleecing people into caring that they have domain specific terminology for that. The code is unarchived, or at least seems to be. If I have a copy in my stash from this exploration, I'll chuck it on archive.org or something.

I decided to investigate an in-browser web3 game based on the Solana blockchain to see how something like that is implemented. I chose the game Degen Islands as it was randomly suggested to me on twitter.

The game isn't live yet, as the NFTs to play have yet to be minted. But a demo is available for potential investors to play around in, so I focused on that.

It's nothing special, it's coded in Unity, exported to WebGL, and hosted on an AWS server. The core concept is that you can spend your time hanging out on your island or mining it for a SPL token called $NUGGET which can be found in ore blocks.

It plays poorly, likely due to being built on-top of an already existing Minecraft unity clone base. The player appears to be 2x2x2 blocks in size, making mining tedious.

However, I soon found a killer bug in how the game interacts with the Solana blockchain. The demo uses the Solana devnet, so although you get $NUGGETs, they're on the worthless development chain.

When the player mines some $NUGGET ore, the client sends a post request to the endpoint https://demo-api.degenislands.com/token/transfer.

When prettified for legibility, the request looks like this:

{
    "toPubKey": "5SJzmw46DhgtVxqXmJYdb3PpRbZ32S7mrbXVVMVa8YkY",
    "amount": 10
}

...Yeah. There's no verification that you mined an ore block, that you did anything in the game. It just takes an address to give $NUGGETs to and an amount variable.

You can only get $NUGGETs 10 at a time in normal gameplay, and the endpoint will silently refuse to honor higher amount values. It gives you a response like you got the 1000 $NUGGETs at once you ordered, but the transaction it sends only transfers the normal 10.

But, you can just hammer the endpoint with the same POST request like nobody's business and get 10 $NUGGET for each and every request.

With just this code, I got hundreds of $NUGGET delivered straight to my devnet address in seconds.

i=0
while [ $i -lt 30 ]
do
    curl -X POST https://demo-api.degenislands.com/token/transfer -d '{"toPubKey": "5SJzmw46DhgtVxqXmJYdb3PpRbZ32S7mrbXVVMVa8YkY","amount": 10}'
    ((i=i+1))
done

Imagine if the code for our actual universe was written by Crypto metaverse developers? 😹