Bug / Malicious bot behavior

[Toff-kun]

Hello,

I don't know where to report this. I had a full set of summer sale cards collected waiting to be unlocked for crafting. When I started ASF today, I received the following trade:

It was auto-accepted by ASF as fair. It left me with 2 cards missing: Umbrella and Happy Cat which I had 1 of each, adding the 4th Cat Nap and the 2nd Cooler cat instead. Sending a return trade offer to the bot with 1:1 dupe trade resulted in a declined trade. Is this a malicious bot using some ASF exploit, a Steam server-side glitch or some ASF bug?

[Rudokhvist]

To investigate this issue, we need:

1. Configuration file of affected bot (don't forget to replace sensitive information like logins/passwords with *** firtst!)
2. Full log file when this situation happened. If you restarted asf since then, look in log folder, otherwise just attach log.txt from asf folder.
3. Describe inventory state (only for this badge of course) before and after trade - something like "CardA - 3; CardB -5; ..."

[Toff-kun]

Prior to the trade I had 1 card each with the exception of Cat Nap (had 3 of those).
I believe the trade in question was 6166542893.

Isn't it already weird that the trade included many of the same cards on both sides?

Tell me if there's some info I edited that was necessary.

Toff.json.txt

log_bot.txt

[Rudokhvist]

So far I'm unable to reproduce your issue.
Here is a test case I made:

	[TestMethod]
	public void ToffkunCase() {
		HashSet<Asset> inventory = new() {
			CreateItem(1, 1),
			CreateItem(2, 1),
			CreateItem(3, 1),
			CreateItem(4, 1),
			CreateItem(5, 1),
			CreateItem(6, 1),
			CreateItem(7, 1),
			CreateItem(8, 1),
			CreateItem(9, 1),
			CreateItem(10, 1),
			CreateItem(11, 3)
		};

		HashSet<Asset> itemsToGive = new() {
			CreateItem(8, 1),
			CreateItem(5, 1),
			CreateItem(7, 1),
			CreateItem(3, 1),
			CreateItem(2, 1),
			CreateItem(10, 1),
			CreateItem(6, 1),
			CreateItem(4, 1)
		};

		HashSet<Asset> itemsToReceive = new() {
			CreateItem(2, 1),
			CreateItem(8, 1),
			CreateItem(3, 1),
			CreateItem(4, 1),
			CreateItem(11, 1),
			CreateItem(6, 1),
			CreateItem(5, 1),
			CreateItem(1, 1)
		};

		Assert.IsTrue(IsFairExchange(itemsToGive, itemsToReceive));
		Assert.IsFalse(IsTradeNeutralOrBetter(inventory, itemsToGive, itemsToReceive));
	}

And it's passed, which means ASF believe this trade is NOT neutral+.
I'm afraid that's all I can do, you will have to wait till Archi sees your topic, maybe he will have some idea what else to check.

[JustArchi]

ASF logic is used on both ends, that is, ASF sending offer runs function to determine if trade is fair (for you, and for them), and then your end verifies if it actually is (on your end only).

We have unit tests for verification whether the logic works properly. I see @Ryzhehvost already tried to reproduce what you claimed and the unit test has passed, which means the inventory state you claimed wasn't like that in reality. Perhaps you got some extra cards already after trade, perhaps something else, I don't know.

Isn't it already weird that the trade included many of the same cards on both sides?

No, matching algorithm used in ASF can sometimes produce same cards on both ends since it tries to get rid of user's most dupes first, and since the inventory state changes after each pick, new options might get unlocked further during matching.

[Toff-kun]

Then you sent a trade offer that ASF on his end determined as unfair and rejected that one.

The bot I sent the returned offer to had multiples of the cards I requested back from them, I sent the trade manually by checking their inventory. Does ASF check whether the bot has multiple full sets of cards for the same badge and rejects the trade as unfair if it breaks one of such sets?

And I'm not attacking ASF. I was trying to figure out the cause. Imagine my situation. I have collected a single full set of cards waiting for them to be unlocked. I start Steam and ASF the next day, the weird trade gets accepted and I lose the badge progress. I send the return trade manually to the bot that took my cards making sure they have multiples of the cards I request in their inventory, and my trade gets declined. Feels very shady.
I also often see offers from ASF xxx modded, which makes me suspicious as for what kind of modifications some users made to it.

you can't actually unfairly lose inventory, worst is losing set progress, which is temporary as you can still 1:1 match to finish it

You're right, I restored my badge progress with another trade. But thought I should still report this issue in case this was some kind of an exploit.

[JustArchi]

Does ASF check whether the bot has multiple full sets of cards for the same badge and rejects the trade as unfair if it breaks one of such sets?

Yes? You have definition of fairness in trading section on the wiki. If that bot is not set to MatchEverything and you break their set or set progress, that trade is unfair for them and declined.

Imagine my situation.

I understand your situation, I'd also be annoyed by it and probably decide to report it if I was in your shoes. The case is I saw so much of Steam shit by now that I'm not surprised. ASF is open-source, I'm one person, if anybody believes there is something that ASF can do better, he's free to code it, submit it, and I'll always merge it in and release if it truly benefits the program, especially if it fixes some loophole or potential abuse. But there are also situations out of my control which I can't do anything about, such as Steam being Steam. Like with my weather example, if you can't risk wrong weather forecast, the only solution is to stay home, i.e. stop using ASF. I don't recommend it because like I said, such situations are rare and even if they happen they don't make you physically lose anything such as money in actual cards, only badge progress which is temporary inconvenience, but if somebody can't allow it then I don't have any other recommendation for such person.

[Toff-kun]

I really appreciate what you do and I love ASF. The support you provide is extremely fast and I know you do your best. My initial report was a question:

Is this a malicious bot using some ASF exploit, a Steam server-side glitch or some ASF bug?

Thank you, guys, for clearing it up for me. I guess I should unblock that card bot then, heh.

[Rudokhvist]

The reason I initially wanted to make this report is to report a malicious bot behavior that ruined my full set by taking my none-duplicate cards from the full set and declined a trade to return them despite me offering a fair 1:1 duplicate trade.

It's not considered and issue. Anyone can send you any trade, it's not necessary to be and ASF bot on the other side, or any kind of bot at all - user may as well create trade manually and add the same text as ASF adds, and send it. Listing is public, including trade links, so your trades may come from anywhere and be anything, including someone requesting all items from your inventory and giving nothing. That's all totally Okay, since ASF should handle those trades and ignore/reject invalid ones. And if this trade you mention IS accepted by ASF, as you claim, that indeed looks like an issue. I tried to reproduce it and failed, I posted my test so that you could check numbers (no need to be a programmer, it's simply "number of card in set", "how many cards" format), maybe I'm missing something. This is to check that IsTradeNeutralOrBetter function works as intended.
If somehow steam returns invalid inventory (I never experienced such glitches, but there is always a first time..) - well, we can't do much about such case, not even check if ASF worked correctly, since we don't know what it may have returned.
It can be also some but outside of IsTradeNeutralOrBetter, for example steam returned valid data but ASF parsed it wrong... but then again, I have no idea how to reproduce it, and if that was the case - that must be something extremely rare, since none of millions of our users never reported the same.
We are genuinely interested to investigate this issue, and if it's indeed connected to ASF - to fix the bug that caused it, but we are limited in what we can do. If you have any ideas of what else we can do to reproduce it - please share. And please check the test I posted above, if it looks correct to you.

[Toff-kun]

I don't know how to reproduce this issue, as I never experienced it before. I did look through your test yesterday and calculated the trade result, seems correct to me.

By the way, I remembered I took a screenshot of my badge progress after the aforementioned trade. It's easy to retrace my inventory back to its pre-trade state (click to display):

Post-trade progress

And tonight I faced with a similar, but the opposite issue, a fair trade was ignored as unfair:

Pre-trade progress

ASF console

Ignored trade

Post-trade progress

Inventory history

I accepted the trade manually. I still suspect it's Steam's feeding incorrect or outdated inventory data for some reason, and I think it started with this summer sale, at least for me. I didn't monitor my other badge progresses and I don't have any complete sets atm to test it, so I'm not sure whether it affects all of my badges or just the summer sale one.