Double check bids before doing transaction

hackerspace-ntnu · Jun 8, 2024 · 16a2e89 · 16a2e89
1 parent 6180cea
commit 16a2e89
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 4 deletions.
diff --git a/Assets/Scripts/Auction/BiddingPlatform.cs b/Assets/Scripts/Auction/BiddingPlatform.cs
@@ -1,4 +1,5 @@
 using Mirror;
+using Org.BouncyCastle.Tls;
 using TMPro;
 using UnityEngine;
 using UnityEngine.UI;
@@ -137,6 +138,13 @@ public void PlaceBid(PlayerIdentity playerIdentity)
         CmdPlaceBid(playerIdentity.id);
     }
 
+    private bool CanBid(PlayerIdentity bidder)
+    {
+        bool isLeadingPlayerAndCanIncrement = bidder.id == leadingBidder && bidder.chips > 0;
+        bool bidderHasEnoughChips = bidder.chips > chips;
+        return isLeadingPlayerAndCanIncrement || bidderHasEnoughChips;
+    }
+
     // All players should be able to place bids, thus we ignore authority (for the time being).
     // TODO verify that the player is on the platform and is from the connection that calls this cmd.
     [Command(requiresAuthority = false)]
@@ -158,8 +166,7 @@ private void CmdPlaceBid(uint playerID)
 
         Debug.Log($"Got bidding request from {playerIdentity.ToColorString()} (chips={playerIdentity.chips}) on {item.displayName} (chips={chips}, leader={leadingBidderIdentity?.ToColorString()})");
 
-        bool leadingPlayerCanIncrement = playerIdentity.id == leadingBidder && playerIdentity.chips > 0;
-        if (playerIdentity.chips > chips || leadingPlayerCanIncrement)
+        if (CanBid(playerIdentity))
         {
             Debug.Log($"Accepted request from {playerIdentity.ToColorString()} on {item.displayName}");
             RpcAcceptBid(playerIdentity.id);
@@ -181,6 +188,13 @@ private void RpcAcceptBid(uint playerID)
         }
         var playerIdentity = player.identity;
 
+        if (!CanBid(playerIdentity))
+        {
+            Debug.LogWarning($"Invalid bid request from {playerIdentity.ToColorString()} for {item.displayName}");
+            onBidDenied?.Invoke(this);
+            return;
+        }
+
         // TODO consider rewriting some of the following
 
         // Refund
@@ -197,7 +211,7 @@ private void RpcAcceptBid(uint playerID)
         chips++;
         playerIdentity.UpdateChip(-chips);
         itemCostText.text = chips.ToString() + "<sprite name=\"chip\">";
-        leadingBidText.text = playerIdentity.playerName.ToUpper()+":";
+        leadingBidText.text = playerIdentity.playerName.ToUpper() + ":";
         LeanTween.value(
             gameObject,
             (color) => material.SetColor("_BidderColor", color),

diff --git a/Assets/Scripts/Gamestate/PlayerIdentity.cs b/Assets/Scripts/Gamestate/PlayerIdentity.cs
@@ -60,7 +60,16 @@ private void Start()
     public void UpdateChip(int amount)
     {
         if (amount == 0) return;
-        chips += amount;
+        if (chips + amount < 0)
+        {
+            Debug.LogWarning($"Player {id} {ToColorString()} almost got negative chips {chips + amount}");
+            // Safeguard against cheating by locking chip amount to 0 when this sort of bug appears.
+            chips = 0;
+        }
+        else
+        {
+            chips += amount;
+        }
 
         onChipChange?.Invoke(chips);