prosolis 65a48b4bd7 mischief: an escalation is two people's money, not one's ...

`paid` carries the buyer's stake AND the escalator's delta, but every
refund path handed all of it to the buyer. Buy an elite (€350), let
somebody bump it to a boss (+€850), let the target walk out of the
dungeon: the 90% fizzle refund pays the buyer €1080. A €730 profit,
funded by the escalator, who loses €850 and is never told. Same in the
unstageable and stranded-sweep refunds, at 100%.

mischiefOutlay splits the pot back into its two stakes — derived, not
stored: an escalation is exactly one rung and happens once, so it is
always the fee gap to the tier below. Both are refunded separately, and
the sink is booked against whoever actually paid it.

Three more from the same review:

- A crash mid-delivery stranded the ward on the target's sheet forever.
  clearMischiefBlessings runs on a defer, which is the one thing a crash
  skips — and the stale sweep exists because deliveries do die. It takes
  the cushion back now.
- dmMischiefVictim told the target to run `!mischief bless @<display
  name>`. The command splits on whitespace, so "Misty Blue" resolved on
  "@Misty" — or on somebody else. It's the only command the ward window
  has. Use the MXID.
- Two blessers landing together both announced "1 of 3" for a contract
  carrying 2; the count the CAS is authoritative for was being re-derived
  from a stale read.

2026-07-13 21:53:47 -07:00

24 KiB

Raw Permalink Blame History

View Raw