Graal Stock Market

[Gunderak]

Today I present you with a fully functional mini stock market.
Each player starts with $1,000 virtual cash (clientr.stockcash).
You can then purchase stocks (defined in the DBNPC "Stocks").
When the NYSE stock market is open, the stocks will update every second.
Whilst the NYSE market is closed players can still purchase stocks and sell, but won't make any profit or loss.
The configuration is pretty simple.
In the DBNPC "Stocks", just add the stock name and symbol to the array.
Then upload the weapon script and add it to whoever.
All code can be found in the attached file, Stocks.zip.
It's important the DBNPC is named "Stocks".
The code may not be the best way to do it all but it works and is fairly secure.
To purchase a stock, select it on the left and then change the quantity with the up/down buttons and click buy.
Selling, select it on the right hand side and click sell.

Edit:
v1.2
Updated code to provide live stock data when market is closed.
Fixed a few bugs.
Fixed a possible exploit.
v1.3
Added charts.

[papajchris]

Really cool. I think something like this would be a far better way to gamble than bet flipping on Era.

[Hezzy002]

Let me know when this goes live, I already found 3 exploits just looking through the code once-over. Can't wait to break your server.

[BboyEatsbacon]

Originally Posted by Hezzy002

Let me know when this goes live, I already found 3 exploits just looking through the code once-over. Can't wait to break your server.

Why not suggest ways to patch this rather than being a **** about it?

[Hezzy002]

because i dont like gunderak!!

[BboyEatsbacon]

Originally Posted by Hezzy002

because i dont like gunderak!!

Oh, proceed then.

[Gunderak]

Hezzy just **** off.
You're so cool, you'll hack virtual currency in a game.
And how do you suppose to hack it, it's all server side.
Might make even more checks just to piss you off.

[Hezzy002]

kiss me gunderak

[Gunderak]

Just piss off.
I coded it to be a bit of fun.
Not for people like yourself to just offer negativity towards it.
If you have something useful to say, feel free. Otherwise, go crawl back under that rock of yours.

[Tricxta]

You know... it'd be "way cool" if you made your own independent system and base stocks off in game businesses. Then determine stock price via items sold each day or whatever, amount of stocks available and demand for that stock.

Also I notice you don't have divdends implemented, always room for an update!

[Gunderak]

I was considering making my own stocks, I did to some degree, But it failed.
And basing it off items wouldn't really work, seeming you'd have to code it in your self.
So it would work for one server only really.
And dividends, eh, I mean I suppose you could make it pay out every hour of online time or something, I don't know. Can't really make it annually lol.

[Gunderak]

This was my initial attempt at making fake stocks.
Instead of having to wait t'ill the real stock market is open.

PHP Code:

function onCreated(){
  onTimeout();
  this.stocks = {
    {"Graalordinates", -2, 12},
    {"PlayerKillCo", -5, 3},
    {"UnixmadBreadFund", -7, 10},
    {"BrokeLenders", -6, 13},
    {"Gold", -1, 23},
    {"Silver", -0.5, 12},
    {"Oil", -2.6, 15},
    {"Facebook", -4, 18},
    {"Google", -3, 14},
    {"Yahoo", -2, 11},
  };
}
function onTimeout(){
  for(i = 0; i < this.stocks.size(); i ++){
    temp.stock = this.stocks[i][0];
    temp.min = this.stocks[i][1];
    temp.max = this.stocks[i][2];
    temp.amnt = random(min, max);
    if(this.stock_price.(@stock) < amnt){
      this.stock_price.(@stock) += random(0.01, 0.02);
    }
    if(this.stock_price.(@stock) > amnt){
      this.stock_price.(@stock) -= random(0.01, 0.02);
    }
    temp.min = this.stock_price.(@stock) < 0;
    this.stock_price.(@stock) = this.stock_price.(@stock[0]).substring(0, (min?5:4));
  }
  settimer(5);
} 


[BlueMelon]

PHP Code:

  if(params[0] == "Buy"){
    temp.rate = Stocks.stock_price.(@params[1]);
    temp.amnt = params[2];
    temp.price = amnt*rate;
    if(clientr.stockcash >= price){
      clientr.stockcash -= price;
      clientr.stocks.(@int(random(1,9999999)))= {params[1], rate, amnt};
      clientr.stockcash = clientr.stockcash.substring(0, clientr.stockcash.pos(".") + 3);
    }
  }
  if(params[0] == "Sell"){
    temp.rate = Stocks.stock_price.(@params[1]);
    for(temp.i : getstringkeys("clientr.stocks.")){
      temp.amnt = clientr.stocks.(@i)[2];
      temp.price = amnt*rate;
      temp.checkname = clientr.stocks.(@i)[0];
      if(checkname == params[1]){
        temp.checkrate = clientr.stocks.(@i)[1];
        if(checkrate.pos(params[2]) >= 0){
          temp.checkquantity = clientr.stocks.(@i)[2];
          if(checkquantity == params[3]){;
            if(clientr.stocks.(@i) == null) return;
            clientr.stocks.(@i) = null;
            clientr.stockcash += price;
            return;
          }
        }
      }
    }
  } 


No validation? Huge security holes... What if params[1] or params[2] was negative?
clientr.stockcash -= -(price);

See where I'm going?

[Gunderak]

Originally Posted by BlueMelon

PHP Code:

  if(params[0] == "Buy"){
    temp.rate = Stocks.stock_price.(@params[1]);
    temp.amnt = params[2];
    temp.price = amnt*rate;
    if(clientr.stockcash >= price){
      clientr.stockcash -= price;
      clientr.stocks.(@int(random(1,9999999)))= {params[1], rate, amnt};
      clientr.stockcash = clientr.stockcash.substring(0, clientr.stockcash.pos(".") + 3);
    }
  }
  if(params[0] == "Sell"){
    temp.rate = Stocks.stock_price.(@params[1]);
    for(temp.i : getstringkeys("clientr.stocks.")){
      temp.amnt = clientr.stocks.(@i)[2];
      temp.price = amnt*rate;
      temp.checkname = clientr.stocks.(@i)[0];
      if(checkname == params[1]){
        temp.checkrate = clientr.stocks.(@i)[1];
        if(checkrate.pos(params[2]) >= 0){
          temp.checkquantity = clientr.stocks.(@i)[2];
          if(checkquantity == params[3]){;
            if(clientr.stocks.(@i) == null) return;
            clientr.stocks.(@i) = null;
            clientr.stockcash += price;
            return;
          }
        }
      }
    }
  } 


No validation? Huge security holes... What if params[1] or params[2] was negative?
clientr.stockcash -= -(price);

See where I'm going?

No validation?
It checks with the database NPC.
And I haven't thought about if stocks are that negative.
Generally people don't buy negative stocks..
And it does check if your money is greater than or equal to the stock you're buying.
And the priced is taken from the DB NPC.

[Hezzy002]

Originally Posted by Gunderak

No validation?
It checks with the database NPC.
And I haven't thought about if stocks are that negative.
Generally people don't buy negative stocks..
And it does check if your money is greater than or equal to the stock you're buying.
And the priced is taken from the DB NPC.

-rep for being retarded

[Hezzy002]

not only that but stocks are stupid

[James]

lol ^

[ff7chocoboknight]

Dsider trollin' the nerds. lol

[BlueMelon]

Validation as in, are you getting the right input? What if the triggers value (from clientside) was modified to send a negative value in the trigger? (Happened on era, that's why I'm saying this)

[DustyPorViva]

Checking for things like negative input is something you really need to get into a habit of doing. That kind of **** is what will let a player walk away from a bank with a free million dollars/gralats.

[smirt362]

Originally Posted by DustyPorViva

Checking for things like negative input is something you really need to get into a habit of doing. That kind of **** is what will let a player walk away from a bank with a free million dollars/gralats.

Delteria's banking system was like this

[Gunderak]

The value can't be negative. As you can't buy - stocks.
I'll add an extra check anyway..

[xXziroXx]

Originally Posted by Gunderak

The value can't be negative. As you can't buy - stocks.
I'll add an extra check anyway..

You have t o realize that any clientsided code can be altered with various memory editors and whatnot, thus, anyone with the knowledge and enough free time on their hands can modify the trigger and send a negative value with it. ALWAYS make sure things are as they should be on clientside AND serverside.

[BlueMelon]

Originally Posted by Gunderak

The value can't be negative. As you can't buy - stocks.
I'll add an extra check anyway..

Since you are sending the values FROM client-side, TO server-side, they can be edited before sending the values. The trigger params can be edited by anyone who knows how. Always do serverside validation, making sure you have the correct values...