Skip to content

Fix gumball buff leaking to the wrong nano on slot change#321

Open
kamilprzyb2 wants to merge 1 commit into
OpenFusionProject:masterfrom
kamilprzyb2:fix/gumball-buff-slot-leak
Open

Fix gumball buff leaking to the wrong nano on slot change#321
kamilprzyb2 wants to merge 1 commit into
OpenFusionProject:masterfrom
kamilprzyb2:fix/gumball-buff-slot-leak

Conversation

@kamilprzyb2

Copy link
Copy Markdown
Contributor

Fix gumball buff leaking to the wrong nano on slot change

Problem

The gumball (stimpak) buff is keyed to the nano slot (ECSB_STIMPAKSLOT1 + slot), not to the nano that consumed the gumball. Nothing cleared that buff when the slot's occupant changed, so swapping equipped nanos (or replacing one in place) left the buff on the slot and the incoming nano inherited the boost.

This bypasses the gumball/nano-style match check in useGumball() (a gumball can be applied to a nano whose style it doesn't match) and shows the buff icon on the wrong nano in the client HUD.

Fix

Drop the slot's stimpak buff whenever its occupant changes:

  • nanoEquipHandler — when a different nano is equipped into the slot. A slot swap carries no source-slot field and no dedicated opcode, so the client expresses it as in-place NANO_EQUIP overwrites; this is the path that catches the reported exploit.
  • nanoUnEquipHandler — when the nano leaves the slot.

removeBuff() clears the effect and resends the corrected condition bitflag, so both the gameplay boost and the HUD icon are fixed.

Testing (protocol 104)

Reproduced on an unpatched build and confirmed fixed on the patched build, covering:

  • Equipping a new nano onto a buffed slot.
  • Unequip + re-equip.

Normal gumball use on the matching nano is unaffected.

🤖 Generated with Claude Code

The gumball (stimpak) buff is keyed to the nano slot
(ECSB_STIMPAKSLOT1 + slot), not to the nano that consumed the gumball.
Nothing cleared that buff when the slot's occupant changed, so swapping
or replacing an equipped nano left the buff on the slot and the incoming
nano inherited the boost. This bypassed the gumball/nano-style check in
useGumball() and mislabeled the wrong nano as buffed on the client HUD.

A slot swap carries no source slot and no dedicated opcode, so the client
expresses it as NANO_EQUIP packets that overwrite slots in place; drop the
slot's stimpak buff in nanoEquipHandler whenever the occupant changes, and
in nanoUnEquipHandler when the nano leaves the slot. removeBuff() clears the
effect and resends the corrected condition bitflag, fixing both the boost
and the HUD icon.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant