13AUG24 - URL-editing Exploit Closed

The DEVS have taken decisive action to identify, confirm, and rectify an exploit that was recently used in a live combat setting between 2 players and called out in a subsequent petition. The exploit involved circumventing the game’s user interface to claim sovereignty on a square co-occupied by a rival.

Sov Claiming on a Square with an Inbound Exodus

As many players are aware, claiming sovereignty on a square with an exodused city inbound is prohibited by the game’s design. If a player encamps an army on a square that has an exodused city inbound to it, the “Claim Sovereignty” option in the pop-up navigation on the tactical map for that square will not appear. Additionally, to our knowledge, there are no other paths for implementing a sovereignty claim on a square with an inbound city on any other navigation or functionalities offered to users in the UI of the game.

Details of the Exploit 

The DEVS were able to confirm that sovereignty was initiated on the square in question after the petitioner's city was en route to it:

- Exodus was initiated at 2024-08-11 15:17:15.517

- The sov claim was initiated at 2024-08-12 00:07:12.500 - Exodus arrived at 2024-08-12 01:49:26.837

This safeguard was circumvented by a player not by creative use of the game’s features or user interface, but by editing the URL of the sovereignty claim confirmation page with the coordinates of the square that otherwise would be prohibited from being sov’ed. Specifically, the sequence of the exploit is as follows:

• The player places an encampment on the square with a neutral/hostile exodused city inbound to it. 

• The player encamps a second army on a square where sovereignty can be claimed. 

• A sovereignty claim is initiated on the square with the second encampment. 

• On the sovereignty claim page, the URL is edited to include the coordinates of the target square:  https://elgea.illyriad.co.uk/#/Town/ClaimSovereignty/Xcoords/Ycoords.

• Doing this causes the page to populate with the coordinates of the target square and allow the player to claim sovereignty – a function that could never be achieved using Illyriad’s player-facing user interface.

Having the occupied army on the square fulfilled the requirements of having an army from the sov-claiming city, but manipulating the URL circumvented the user interface.

This exploit has been closed by the dev team.

The URL is not part of Illy’s UI

It should be reiterated that, while several of the game’s graphical interfaces were used to initiate this exploit, it was the manipulation of the URL that allowed circumventing what the GUI seeks to prevent in-game. The editable text box where the URL of any web page resides is a component of a web browser – it is not part of Illyriad and the game is not designed to be traversed by players forcing their way through the safeguards of the graphical user interface by making changes to URL structures. We feel that this fact of the game is eminently self-evident.

Consequences of the Exploit

We took this exploit very seriously because it gave players an unfair advantage in combat situations by allowing the player with claimed sovereignty to monitor armies occupying the city, as well as other scenarios that could break the game state.

In short, the exploit created an unlevel playing field, which is against the principles of fair play that we uphold in our community. 

GM Stormcrow was very clear in his remarks about the “GDT Hacks” in May, 2024 when he noted (emphasis added):

"If you directly let us know about an exploit that you’re aware of, there’s currently an amnesty on the ‘how-to’ knowledge, but not the practice. 

I’d rather know about it and get it closed than throw people out of the game, but my patience threshold for players and alliances who continue to use GDT exploits has been broached."

While this case is not technically classified as a "GDT hack," it nonetheless violated the spirit of SC’s warning and the integrity of our platform. We want to make it clear - again - that we are done tolerating any attempts to manipulate URLs, leverage GDT, or similar methods to achieve results that the user interface was clearly not designed to allow. Any such actions will result in the permanent loss of your account.

Players are strongly urged to stop experimenting with subversive tactics like these – particularly when other players’ cities are at stake. A good game rule is: If the UI won’t let me do it, don’t look for ways to get around it.

In this specific case, we have taken action against the player who used this exploit against a rival player in a live combat setting, issuing a suspension of the account. 

We urge everyone to respect the rules of the platform and play fairly. Let's keep the game enjoyable and competitive for everyone.

Thank you for your understanding and cooperation.

Sincerely,

The Illyriad Development Team