The Beginning
I was one of the lucky people who came across a Twitch livestream a few days before CryptoKitties experienced exponential growth:
And just as the game took off and ETH flowed in like crazy, I bred a shipcat, a Fancy cat for those less experienced CryptoKitties breeders. At the time, this was the 120th shipcat bred and one of only 35 on the market. It looked a bit like this:
Well, this cat ended up selling for 0.83 ETH and within a few days I had made over $1000 on a $50 investment.
2 is Better Than 1
That weekend I came home -- I live in SF and my parents live an hour away. After telling my dad about the craziness of CryptoKitties, I went to the grocery store with my mom to pick up a couple things. We come back less than an hour later and my dad had installed MetaMask, setup a Coinbase account, and purchased his first CryptoKitty (before this, cryptocurrency was just funny money and CryptoKitties "one of the most ridiculous things he had ever heard of").
Yep... Cryptokitties was my father's introduction to cryptocurrency.
One Month Later
As apparent from the graph above, the Cryptokitties craze did not last very long. Most people, like myself, made a little bit of ETH and cashed out. However, my father still had a few cats left and with the market looking bearish, he was looking for new ways to sell his cats -- from the subreddit to the discord channel to Steemit.
Coming home one weekend, I decided to help my dad sell his remaining cats. After a few hours of brainstorming and hacking around, we came up with a plan.
Hacking CryptoKitties (well, sort of)
Since I had quit Cryptokitties, a few new features had been released. One particular feature, likes, was a little shaky in it implementation -- it was exploited only days after its creation.
However, the average Cryptokitties user is not very tech saavy, so most of the like exploits were simply people creating multiple accounts on MetaMask and liking up their own cat. While this is effective for maybe 10-100 likes, it gets very time consuming when done in large quantities.
Having had some experience with web3.js I sought to repeat this liking process, but with code. Here is the end result (this is a cat with an absurd number of likes):
The Code
Here is a walkthrough of the "hack":
- Generate a public/private keypair.
- Digitally sign the word "Cryptokitties" and send this signature along with your public key to the CryptoKitties API.
- Receive back a login token.
- Use this login token to like a cat.
- Repeat as many times as you like.
This is what it looks like in action:
const web3 = require("web3")
const Web3 = new web3('ws://localhost:8546');
const axios = require("axios");
async function hackTheCats(address, signature, origin, catid) {
try {
const response = await axios({
method: "post",
url: "https://api.cryptokitties.co/sign",
data: {
sign: signature.signature,
address: address.toLowerCase()
},
headers: {
"Content-Type": "application/json;charset=UTF-8",
Referer: "https://www.cryptokitties.co/sign-in",
}
})
const response2 = await axios({
method: "post",
url: "https://api.cryptokitties.co/kitties/"+catid+"/purr",
headers: {
Authorization: response.data.token,
}
})
console.log(response2.data.purred);
} catch(err) {
console.log(err);
}
}
function loopTheHack(n, catid) {
for (var i = 0; i < n; i ++) {
const account = Web3.eth.accounts.create();
const address = account.address;
const signature = account.sign("Cryptokitties");
hackTheCats(address, signature, i, catid);
}
}
Success!
One major drawback of games like CryptoKitties is the search-ability of your digital assets -- how easy is it for others to find the asset you are trying to sell. Lucky for me, likes was one of the filters provided in the CryptoKitties marketplace, so since I was the only one programmatically liking cats, I was easily able to dominate the marketplace. My strategy?
- Like a cat until it is the most liked cat on the market
- Sell
- Repeat
Here are the two accounts I was using:
- 0x97b2f877098B9ff46B86650290B13f85881fC9E5
- 0x4Cfc6cdA90a0D338B99bFD35A4d75Fa97bFD17e4
You can see how much I made here: https://kittyrush.herokuapp.com/
Here are some of the cats I sold:
And of course, with 240,000+ likes, the most liked cat in the game:
Can I Use this Hack?
No, (un)fortunately the CryptoKitties dev team has covered up this exploit, allowing only those with at least one cat to like other cats. This means, to replicate the above, you would need to pass a cat back and forth between accounts -- by the time you get to 20,000+ likes, the $$$ you spend on gas would be more than you could possibly make from the liked up cat.
Takeaways
With real money on the line, even the most ridiculous crypto games are target to hacks/exploits. However, I would argue that crypto games are even more open to such exploits because the average online crypto user is an easier target than a USD gamer:
- Transactions are final (once the money is sent, it is gone)
- The average joe still has no idea how cryptocurrency works and thus has a harder time differentiating between legitimate, semi-legitimate, and illegitimate crypto websites
- Due to the volatility of crypto prices and due to the fact prices on these Ethereum games are displayed in ETH, people sometimes forget how much money they are actually spending
So if you decide to engage in any of the wonderful crypto games out there, watch out! It truly is the wild west out there.
This article was written by a friend of mine original article is here https://medium.com/@robdurst/how-i-beat-cryptokitties-f9aa71c03c87
FOLLOW UPVOTE RESTEEM Thx!
great article! Im glad you found this bug and were able to slightly profit off of it. You spent the time discovering it, and hence were able to derive value. By you discovering this bug and reaping benefit from it --- it was then discovered and eventually patched. So all in all - win - win :)
Well put together content! Great post. Upvoted/Resteemed.
Rob provided me with this liking service ;) It was good while it lasted
Hi! I am a robot. I just upvoted you! I found similar content that readers might be interested in:
https://medium.com/@robdurst/how-i-beat-cryptokitties-f9aa71c03c87
You got a 12.29% upvote from @slimwhale courtesy of @steven-patrick!
@steven-patrick thought you deserved 8.47% of our upvote for this post.
I'm here to tell you congratulations and to let everyone know there's a livestreaming service available for Steem. You can go live and start earning rewards via the Steem blockchain today at dlive.io!
This post has received a 0.51% upvote from
thanks to: @steven-patrick.
For more information, click here!!!!
Try the new Minnowhelper Bots for more information here
Help support @minnowhelper and the bot tracker by voting for @yabapmatt for Steem witness! To vote, click the button below or go to https://steemit.com/~witnesses and find @yabapmatt in the list and click the upvote icon. Thank you.
Voting for @yabapmatt
Congratulations @steven-patrick! You have completed some achievement on Steemit and have been rewarded with new badge(s) :
Click on any badge to view your own Board of Honor on SteemitBoard.
To support your work, I also upvoted your post!
For more information about SteemitBoard, click here
If you no longer want to receive notifications, reply to this comment with the word
STOPDo not miss the last announcement from @steemitboard!
You got a 7.69% upvote from @pushbot courtesy of @steven-patrick!
You got a 33.33% Prime Upvote from @alphaprime courtesy of @steven-patrick!
All Upvoted posts are considered for additional Upvotes and Resteem based on quality content criteria chosen by our moderators in an effort to give something back to the community.
You got a 12.12% upvote from @childfund courtesy of @steven-patrick! @childfund is a bid bot to help the steem community sponsor a child.
You got a 33.33% upvote from @lrd courtesy of @steven-patrick!
You have been defended with a 14.53% upvote!
I was summoned by @steven-patrick.
You got a 33.33% upvote from @bluebot courtesy of @steven-patrick!
You got a 0.41% upvote from @emperorofnaps courtesy of @steven-patrick!
Want to promote your posts too? Send 0.05+ SBD or STEEM to @emperorofnaps to receive a share of a full upvote every 2.4 hours...Then go relax and take a nap!
You got a 50.00% upvote from @peace-bot courtesy of @steven-patrick!
Help spread the peace. Want to promote your posts too? Send a minimum of .02 SBD or STEEM to @peace-bot with link in the memo for an upvote on your post. You can also delegate to the bot for daily passive earnings. If you would like to delegate to the Peace Bot you can do so by clicking on the following links:
50SP 100SP 250SP 500SP 1000SP 5000SP
Learn more!
@fishbaitbot is luring fishes with a 51.61% upvote thanks to @steven-patrick!
Delegate to the @fishbaitbot and get 100% of the profits which is better than all upvote bots! Click on one of the following links to delegate 50SP, 100SP, 250SP, 500SP, 1000SP or 5000SP.
This bot, the steembottracker and some other projects were made possible thanks to @yabapmatt. Make sure you vote for him as witness!