hoatv2211 Network Authority and Exploit Review
Overview
Review who may request, validate, authorize, rate-limit, persist, and broadcast sensitive game actions without performing offensive testing.
When to use
Use for client-authoritative currency, inventory, combat, movement, reward, trade, admin, replay, duplication, or rate-limit concerns.
When NOT to use
Do not use to send exploit payloads, bypass authentication, scan external systems, or replace an authorized penetration test.
Required inputs and context discovery
Collect action list, trust boundaries, initiators, authoritative side, server validation, idempotency, replay protection, rate limits, persistence, audit logs, and supported threat assumptions.
Safety and risk level
Read-only static review. No live traffic, credential use, service control, player-data access, or exploit proof is authorized.
Workflow
- Map clients, gateways, servers, databases, and administrative trust boundaries. Completion criterion: every sensitive transition has an owner.
- Inventory sensitive actions and their authoritative side. Completion criterion: client-authoritative sensitive state is visible.
- Review validation, idempotency, replay, sequencing, and rate-limit guards. Completion criterion: missing guards become discrete findings.
- Trace persistence and broadcast behavior for abuse amplification. Completion criterion: exploit impact is bounded without attack execution.
- Rank source fixes and safe regression simulations. Completion criterion: live exploit attempts remain BLOCKED.
Evidence and output contract
Produce network-authority-review.json with trust boundaries, action contracts, findings, severity rationale, limitations, and defensive tests.
Handoff contract
Record reviewed actions, authority decisions, missing guards, sensitive paths, untested live assumptions, and next defensive owner.
Pitfalls and anti-rationalization
- Encryption does not replace server authority.
- A client UI restriction is not server validation.
- Do not prove impact on a live environment.
- Static review does not certify exploit absence.
Verification checklist
- Trust boundaries are explicit.
- Sensitive actions have authority owners.
- Validation, replay, and rate limits are reviewed.
- Findings cite source contracts.
- No attack traffic was sent.
References and scripts
Use the bundled scripts/authority_review.py on normalized action declarations and project-specific server contracts.