Author: Damocles
I. Overview
BigTime caused a sensation in GameFi after launching its token on October 10, 2023. The team began to pay attention to BigTime in September but was unable to analyze it due to lack of qualifications. After recently lowering registration barriers, we started a series of security analyses and tests on BigTime, including testing for game client property tampering, malicious GameRPC calls, token contract audits, etc. Through the overall assessment of the game, we found that its security is poor, and the cost of cheating for malicious players is low. Additionally, the analysis difficulty of the game is low. If the project party wants to continue operating the game, improving the security and fairness of the game should be prioritized in post-launch operations.
II. Game Background
Game Version Being Evaluated: v0.28-CL#78459
Game Type & Game Engine: MMORPG, UE4.27
Potential Issues in Game Mechanics:
1. Illegal Movement (using RPC for malicious packet injection for teleportation, acceleration, etc.)
2. Acceleration (game world time, time functions under the UE framework)
3. One-Click Combos / One-Click Skill Loops
4. NFT Forging Acceleration
5. NFT Random Number Manipulation
6. Multiple Settlements After Instance Completion
III. Game Security Analysis
Game Code Protection:
Analysis Process:
Since different engines have different analysis modes, after obtaining the game EXE, it is first necessary to determine which engine the game uses. By identifying the basic information of the game, we can determine that the game is developed using UE27.2.
After importing the game into IDA, it was found that the game code had not been hardened, and by searching for the feature code of UE27, the GWorld variable can be quickly located.
It can also be found that the strings are not encrypted.
Therefore, after confirming that GWorld can be located through feature codes and that the game is not encrypted, it is possible to extract the NamePool feature code using some SDK Dump tools for dumping.
After obtaining the game SDK, analysis can be accelerated.
Analysis Conclusion:
BigTime scores 0 in game code protection, with no protection at all. In traditional games, customized encryption and packing are often used to protect source code. Due to BigTime's lack of a sound game code protection mechanism, the barriers and costs for malicious players to analyze the code are very low. If hacks appear, it is unfair to normal players and may affect the game's economic model.
Game Basic Anti-Cheat:
Analysis Process:
In terms of basic anti-cheat detection, we mainly test from two aspects: whether the game has anti-debugging and whether the game has read-write protection.
Using CE for attaching during the game being open and setting breakpoints on common functions, it was found that the game did not exit or prompt.
By using CE to modify the Health in-game, it was found to be effective, and the game did not prompt or alert (modifying Health is only to show more intuitively; this field is generally stored on the server, and local modifications have no effect).
Analysis Conclusion:
BigTime scores 0 in anti-cheat capability, allowing malicious users to cheat at will.
The reason for only testing anti-debugging and read-write protection is that for a cheat tool, finding data and implementing functionality can be achieved through debugging and reading/writing. If the most basic two protections are missing, then other detections like injection and hook are meaningless.
Game Logic Issues
Analysis Process:
For MMO-type games developed based on UE, the benefits of tampering with local data are low, as UE has a mature synchronization mechanism for synchronizing various Actors and other attributes, as well as server-side verification. However, analysis of the game source code shows that BigTime has not reasonably utilized the attribute synchronization mechanism, and some data still falls to the ground, such as the Comboindex feature. By setting write breakpoints on the combo index, the writing function can be found, and then the combo function can be debugged (specific operations will affect fairness, so no demonstration is provided).
Analysis Conclusion:
The overall game logic security issue of BigTime is not very prominent, but there are still certain security risks, hence the logic security score is 4 points.
For certain sensitive attributes lacking synchronization mechanisms, more should be placed on server-side encryption.
Game RPC Analysis
Due to the sensitivity of RPC issues, we will not conduct analysis without project party authorization. Currently, BigTime's RPC security protection is 0, and for certain RPC packets tested, the server acknowledges them, resulting in a security score of 0. It is recommended that the project party conduct a detailed audit of overall RPC security. The following is some RPC information.
WEB3 Security Analysis:
Overview:
As a chain game, BigTime can be divided into two parts in Web3 design: the basic BigTime token part and the in-game WEB3 economic system part. This part is relatively separated from other games, with the in-game responsible for token production and NFT forging, while deploying a fixed circulating token contract on ETH.
Token Contract Security:
Token Basic Information as follows:
The BigTime token contract adopts a multi-signature wallet to mint tokens, and then deploys with a fixed supply method. Since the current token contract functionality is simple, the basic security of the contract is sufficient. By observing the Tx information of the Owner wallet, it can be seen that after obtaining the tokens, the Owner wallet transferred portions of tokens to several wallets.
Most of these wallets use Safe's multi-signature wallet. Based on this, it can be found that the overall security risks related to the token mainly arise from private key leaks and whether the project party has privileged accounts. Although multi-signature is used, if there are privileged accounts with leaked private keys, there will still be certain risks of theft.
In-Game Economic System Security:
In BigTime, players can enter the space of the Time Guardian to forge hourglasses and recharge them. Some functions that can directly affect market balance have part of their code stored locally. Although it is unclear how GS is designed, such behavior is considered high-risk. As follows
There are many similar RPC functions, and considering the high testing costs, we will not conduct any security tests for now, hoping that the project party can implement strict judgments on this part in the server.
About Damocles
Damocles Labs is a security team established in 2023, focusing on security in the Web3 industry. Business content includes: contract code auditing, business code auditing, penetration testing, GameFi code auditing, GameFi vulnerability mining, GameFi cheat analysis, GameFi anti-cheat.
We will continue to make efforts in the Web3 security industry and output as many analysis reports as possible to enhance the awareness of GameFi security among project parties and users, as well as to promote the safe development of the industry.