pull down to refresh
I'm not arguing whether the pay-to-post mechanism would work, I'm questioning how you prove a post was paid for?
Like, this comment could have been free for me to make because I have special privileges. How can you prove otherwise?
Who's to say the bots will be subject to the same rules as humans? (how do you prove the post was paid for?)
And even if bots are subject to the same rules, they may still get preferential treatment by the algorithm. Or simply game the algorithm better than a human can.
There is no escape.
Life is good!
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
But it could be better.
(made you scroll)
I'm not sure who got this first or better.
@Scroogey defintely did a better job of explaining. He also identified some other critical bugs.
I was mostly gunning for the draining reward. š¤
Thanks for issuing the challenge. I had a lot of fun.
cashuBpGFteCJodHRwczovL21pbnQubWluaWJpdHMuY2FzaC9CaXRjb2luYXVjc2F0YXSBomFpSABQBVDwSUFGYXCCo2FhEGFzeEBmNmYwZGJjM2VlN2MyY2QyMjk5YzNhYjc0NzI4NDgyYWZkOWEyYjFmY2Y4NDYyNDRmZDgwN2EyOTNjOTBkYWQ4YWNYIQM7UYIXD8agQapVduWQ3qDLj9i82xEAxpqiqGuM12W7RKNhYQJhc3hAZDkzNDU1MmUxYTAxNzc1ZTI1MGJhMmQ1YmQ3ZDY3NzYyNmVlNDEzNWM4MmNmZDU2MTA5YWJmMGQ2MjRiZGNmYWFjWCED6LnSVAnG58fwBqF6YI6RibQehWrjqwly6lS3lodiQeNhZHJTZW50IGZyb20gTWluaWJpdHM
Courtesy of @ealvar39
deleted my previous comment because I linked to the wrong line
On the frontend, you have a function called handleUserPayout. This function works correctly. i.e. it will check the number of times a user has been paid out and return better luck next time if the number of remaining attempts 0.
https://github.com/ealvar13/hd-quiz-bitcoin-rewards/blob/30817af5f53c4da9b7dce593f77e37762a0f5dbc/bitcoin-mastermind-rewards/includes/js/bitc_a_light_script.js#L261
However, the function sendPaymentRequest can be simulated by the user by making the same call directly to admin-ajax.php.
There is no check on the remaining number of attempts compared to the handleUserPayout.
(for some reason the script gets cut off, replacing with a pastebin)
- open the networks tab, study the ajax commands
These two were interesting: #871344
- right click, 'copy as curl'
- paste into https://sqqihao.github.io/trillworks.html
- copy into python script
- edit as necessary
- run
The nonce was the same for me as #871344