What this is
An invitation to fuzz the game server: throw malformed packets, truncated saves and broken JSON at it and see what survives. This finds crash classes that no playtest ever reaches. You don't need to understand the gameplay at all.
Targets
- Network message decoding — the codec in
Networking/ (NetCodec). Baseline hardening already exists (1 MB frame cap, catch-all decode), so trivially garbage frames should be handled. The interesting findings are what gets past that: messages that decode but carry hostile values (negative counts, huge ids, out-of-range coordinates) into GameServer/ handlers.
- Transports — the WebSocket gateway and LiteNetLib UDP path: mid-frame aborts, slowloris-style dribble, connection floods.
- Save loading —
Persistence/: truncated / bit-flipped / hand-edited world saves. Loading must fail cleanly, never corrupt or crash-loop.
- Content loading — malformed
data/*.json (there is a strict load-time validator; does anything slip through?).
What counts as a finding
Server crash or hang, unbounded memory growth, a client-supplied value reaching game state unvalidated (item counts! inventory ids!), or a save that loads "successfully" but corrupted.
How to run
dotnet run the server locally (see the developer docs) and aim your fuzzer at it, or write an in-process harness that feeds byte arrays straight into the codec's decode path — the second option is much faster per iteration.
Reporting
Plain crashes → comment here or open an issue with the repro bytes/steps.
Anything exploitable (dupes, auth bypass, remote crash of the public fleet) → please report privately via a GitHub security advisory instead of a public comment. 🙏
What this is
An invitation to fuzz the game server: throw malformed packets, truncated saves and broken JSON at it and see what survives. This finds crash classes that no playtest ever reaches. You don't need to understand the gameplay at all.
Targets
Networking/(NetCodec). Baseline hardening already exists (1 MB frame cap, catch-all decode), so trivially garbage frames should be handled. The interesting findings are what gets past that: messages that decode but carry hostile values (negative counts, huge ids, out-of-range coordinates) intoGameServer/handlers.Persistence/: truncated / bit-flipped / hand-edited world saves. Loading must fail cleanly, never corrupt or crash-loop.data/*.json(there is a strict load-time validator; does anything slip through?).What counts as a finding
Server crash or hang, unbounded memory growth, a client-supplied value reaching game state unvalidated (item counts! inventory ids!), or a save that loads "successfully" but corrupted.
How to run
dotnet runthe server locally (see the developer docs) and aim your fuzzer at it, or write an in-process harness that feeds byte arrays straight into the codec's decode path — the second option is much faster per iteration.Reporting
Plain crashes → comment here or open an issue with the repro bytes/steps.
Anything exploitable (dupes, auth bypass, remote crash of the public fleet) → please report privately via a GitHub security advisory instead of a public comment. 🙏