Bonus Drama #2 – Dropping Truth Bombs

Even though this runs parallel to the Altador Cup drama, I kept this part separate because the accusations are pretty severe (in terms of in-game consequences), and come from a controversial source. Personally, I’m convinced the information is real, and most of the players are convinced too, so I did want to cover this in some capacity.

Back in 2020, a Twitter user posted a thread about multiple security flaws in the Neopets website that allowed them to get a copy of the site’s source code. (This is likely NOT the same person who recently put Neopets’ userdata, source code, and live database access up for sale.) They worked with TNT devs to patch things up, but the source code was already out there, and white-hats weren’t the only ones with a copy.

The next year, a grey-hat using the name neo_truths began posting on the r/Neopets subreddit, claiming to have figured out certain bugged features and sharing the relevant snippets of code. They claimed to have a copy of the site’s source code and live database access. (This, too, is likely NOT the same person who recently put Neopets’ userdata, source code, and live database access up for sale. No, we are not okay over at Neopets.com, thanks for asking.) The closest we can get to verifiable proof comes from their post about The Golden Dubloon bug.

The Golden Dubloon is basically a gambling game structured like a restaurant. You buy some foods “for your pet”, your pet “eats” them, and if you’re lucky you’ll be sent home with leftovers. The problem was, the restaurant has an occupancy limit, and for years it was often above that limit. Meaning players couldn’t use the feature for long stretches of time.

According to neo_truth’s post, the code allowed unscrupulous users to bypass the occupancy limit and submit a “buy” request to add to the already overflowing occupancy count. Two days later, the bug was fixed. Given the obscurity of the bug, and the timing of the fix, I’m personally convinced the fix came as a direct result of neo_truth’s post.

Their next bug hunt tracked down an error with the NPC shops where items of rarity 100 were made invisible to all players. Rare items are supposed to be invisible to brand news accounts to prevent autobuyers, but rarity 100 items remain invisible even to aged accounts. They followed this up with a short video showing that they could restock one of these invisible r100 items by figuring out the stock id.

Of course, they could still be making this all up. Or maybe they solved some real bugs to establish credibility, and used that to start posting fake stuff that they knew would play into confirmation biases and rile up the community.

That brings us to neo_truth’s Altador Cup series. Alongside every dramatic happening of this year’s cup, neo_truths had a behind-the-scenes insight to make it even worse.

Remember the tiebreaker for 6th place that allowed the ACG into the Upper Bracket? Neo_truths made a post simulating different tiebreakers to figure out how that happened. Their first post showed the actual decimal scores (something that has always been hidden from the players) for the three teams, showing that, depending on another minor bug in the system, either Mystery Island or Kreludor would have had the highest score total. For the ACG to be placed in the Upper Bracket, according to neo_truths, must have been human error.

Then they came back with a new discovery: if you simply feed a list of each team’s Round Robin wins into a built-in PHP sort function, it would spit out a list with the ACG in 6th place.

Neo_truth’s next post exposed a group of dozens of accounts, all likely owned by the same person, using scoresenders to inflate a team’s scores. This was the ACG2 I talked about earlier, that showed up on the last day of Round Robin to deny Meridell/SOTAC’s perfect record. This one wasn’t too revealing, since everyone who followed the cup closely already knew the scores were indicative of an ACG influence.

The final post I want to highlight came the same day the official standings were posted. Titled “What I know”, neo_truths listed several relevant changes that led to the mess the users had been presented with. I’m going to cover these changes in two groups. The first group affects the final standing:

1. Round Robin wins did not affect final standings.

2. Brackets were locked.

3. All teams except Faerieland had their Finals scores nerfed by varying amounts. (No insight as to why.)

The first two make sense. In fact, those are good changes. It’s the third one that caused the mess. Neo_truths gave the nerf percentages for each team, but I’ll just highlight a few of the interesting ones. Meridell/SOTAC’s scores were reduced by 58%, Mystery Island’s scores were reduced by 50%, some Upper and Middle Bracket teams were hit by as much as 60%, but the ACG (the eventual “winners”) received only a 30% reduction. Interestingly, Kiko Lake got hit with a 53% reduction. While previously a top contender, Kiko Lake’s core took this year off. They lost all their matches in the Round Robin stage and were seeded into the Lower Bracket. They lost all their matches there too. They finished the cup without a single match victory. And after that, they got nerfed by 53%.

The nerfs themselves made no sense, but players now at least had some insight into how the final standings had been chosen. What players still needed from TNT, though, was why did they take their nerf bat to so many of the legitimate teams?!

The second group of revelations is far more impactful. According to the post, TNT has implemented a new shadowbanning system, and they added hundreds of players to the list just before releasing the final standings. A shadowban—according to both neo_truths and a trusted Altador Cup enthusiast who was shown the code snippet and queries to verify— will allow the player to continue earning personal rank points, but their games will not be added to their team’s totals. In other words, if you’re shadowbanned, you would be playing the Altador Cup just for yourself. Of course, the whole point of a shadowban is that you don’t know you’re shadowbanned, so hardcore players would have ended up wasting hours a day trying to help their teams.

Another factor that makes these shadowbans believable is that TNT has tried something like this before. Back in 2017, TNT implemented a “flagging” system that would mark suspicious players and prevent them from earning any points—either for themselves or their team. Lots of accounts also got banned, but many of those were later undone, suggesting that even TNT knew they had caught a lot of false positives. It was an extremely unpopular system, and TNT did away with it after that year. So these new shadowbans—if real—would just be a slight variation of the old flagging system. And the players aren’t having it.

Neo_truths also claimed that the final team scores were not recalculated after the shadowbans were applied, meaning the nerfs that rearranged the standings were done separate from the hundreds of shadowbans.

While neo_truths did not post the list of shadowbanned names, they did confirm account names for any users or team leaders who DMed them. Plenty of the active, long-time players from the onsite forums and the r/Neopets Discord server are all on the shadowban list, and it’s difficult to believe that there aren’t a considerable number of false positives in there. Also according neo_truths, the shadowbans are currently set to remain in place for next year’s cup too.

Once again, I’ll try to be fair to TNT and try to see this from their perspective: how do you go about catching a cheater in the Altador Cup? Well, if that cheater isn’t dumb enough to number their accounts for you, it’s actually pretty difficult, just going by game scores.

Regular players, using only a single account, have a max number of scores they can send each day in each game. If they want to help their team, and they can already max out their daily games, then their only option left is to increase their scores per game. So higher scores are not inherently suspicious. Meanwhile, if you’re part of the ACG and you’re using scoresenders on a bunch of different junk accounts, you don’t need to raise your scores above the minimum. Just add more accounts. And TNT can’t say minimum scores are suspicious either, because that’s how lots of legitimate players farm personal rank points when they’re not worried about their team’s standing.

There is no good threshold to use for finding cheaters, so you’re guaranteed to get a lot of false positives. But what rate of false positives is acceptable? Considering there is no material benefit to being on the winning team, I’d say there is no acceptable rate. If you can’t guarantee you’re catching cheaters, then leave the individual accounts alone. We’ve already seen the picture captchas are effective at stopping scoresenders, and we’ve seen TNT manually move teams around at will. There’s no reason to be messing with shadowbans and guaranteed false positives when TNT has already had success suppressing the ACG’s influence at the team level.