I seriously got my A$$ ripped off!!!

So two things are going wrong:

1. The voucher was usable more than one time.
2. The purchase should never have paid a discount for wearing the group tag since the item was already free, thanks to the voucher.

I have to ask: Did the transactions take place between 10:00pm and 10:30pm?

My understanding from the thread is that the 10%s were correctly given and the only thing that went wrong is that the voucher was usable over and over again.

Absolutely correct, Phil. They purchased a product with the vouchers, which are a Hippo coupon system with script, set up to interact with the Hippo vendors. The vendors automatically take off what you have purchased from the voucher. The vouchers were for 200 Lindens. These 3 people purchased a dress for 200 Lindens, which was paid for by the voucher, it didnt come out of their pocket. And in turn, while wearing the Badkatz group tag, they recieved a 10% discount, paid to them , by me with Lindens. I should add, I had the vouchers for sale as a way to gift, they came in different amounts, from 25L all the way up to 1000 L.
I want to say Im in NO WAY cutting down the Hippo system, I've used it for years, and yes, there are problems sometimes, but it is a good system. This is a case of 3 people, who are thieves!

Here is one transaction from one of the people..the last one before i went onto the hippo site and unchecked all my vendors to use the voucher.

156 1391531820
Date: 02/07/2009 02:06:24
Object Pays
Region: Radjin 3
Destination: Aileen ####

the 2nd person's last transaction

323 1391468696
Date: 02/07/2009 01:14:49
Object Pays
Region: Radjin 3

and the 3rd person's last transaction
196 1389489490
Date: 02/06/2009 05:24:28
Object Pays
Region: Radjin 3
Destination: Naminee ####

I couldnt list them all here..there is too many, but these are the last transactions these people made...and i blocked out their last names due to TOS rules.
Destination: sylvhanas ####

Please understand, its NOT Hippo's fault! I have never heard of it happening to anyone else. I dont know how these people learned to fraud the system, but I'd like to get to the bottom of it!

Is there any way for the Discount script to know if the item was actually paid for with cash vs a voucher/giftcard? I would think that you would never want to give any cash back if cash was not put in.

You know, you're right, and I never really thought about that. My vendors have always given the discount to group members, but I never took it into consideration about the vouchers.

I was reluctant to say anything, but this seems likely to be a vulnerability with this system. I didn't see anything in the instructions to merchants that told them to set permissions on the contents of the vouchers, only of the vouchers themselves.

Well the contents are usually no mod to begin with, and normally use a notecard for setup. I never bothered with this system, I figured that if they wanted to gift a friend, they could always use the "buy as a gift" option that is already on the vendor, but I can see the use of just giving a gift card.

Yes, Cristalle, I have always used the "buy as gift" button, also. But I've had a lot of customers who could'nt figure it out, or it just didnt work for them, and requests for gift cards. So, I decided to try it.

I looked at the directions on the Hippo site, and it does say to change the perms to no copy on the voucher prim and the script inside. I know you said you changed the perms on the prim... I may have missed if you said you changed the script perms as well.

This made me nervous because my gift card system never mentioned changing the script perms, and I never thought about it before. When I went inworld to test it though, apparently the system I use is scripted to delete the prim if you try to copy the script and put it in a new prim.

Sorry this happened to you Yummy.

Ty Betty, and yes..the script does change to no copy. There are quite a few options with the vouchers, so they really are a good idea. The only thing i saw was that there was no way to refill the card, so if you only have 5 L left..you are kind of SOL.

If I'm understanding that correctly, the person who has the voucher never parts with it, but the system knows how much has been spent from it, and how much is left to spend on it. If that's right, then it will use a central system for it, and it sounds like the system failed to deduct the amount from the voucher. E.g. a person buys something with a voucher, the vendor informs the central system to make sure that voucher has enough money for the item and receives a good response. Then the vendor gives the item (and the cash in this case). But there is something wrong with the central system at the time, and the amount isn't deducted from the voucher's record.

OR ...
Assuming that the group discount isn't incorporated into the Hippo voucher system, does the vendor assume a purchase and check the group tag, and then give the cash discount without any confirmation from the Hippo system? Without knowing the specific setup, I feel that this is a strong possibility. If it does that, then maybe the thieves didn't get the dresses at all, and anyone could re-use vouchers, only getting the cash and not the dresses - it may have been possible for anyone to do it at any time. A person would just have to stand there with the group tag on, using a dead voucher, being told that it doesn't have enough credit each time, but still receiving the cash discount every time. It's down to whether the group checking is dependant on a positive Hippo response, or whether it just does it.

Yumi. If you're not sure about that possibility, I suggest turning a vendor on temporarily, and testing it.

Those are possibilities. Another is that a temporary SL glitch could have caused it, and another is that someone managed to make copies of the voucher, which is what is being assumed in the thread, but I wouldn't assume it. It could well be Hippo's or SL's faultiness at that particular time, or it could be that the group discount system isn't set up to get confirmation from Hippo before giving the money.

Whatever happened, it does teach that cash discounts should not be given on non-cash purchases unless the non-cash system and the discount system are combined.

Oh, so it does. Don't know how I could have missed it. And TBH, I never had a complete theory of how to exploit the system even with copy-perm scripts--but on the other hand, I don't have a complete model for how the system works such that resetting the scripts would only run a "risk" of wiping the voucher value, given that they "store their data encrypted in script memory." That's how I became obsessed with script permissions in the first place.

It's not relevant in this case because the scripts were set no-copy. The thing is, there's only so much a script can do to determine if it's where it belongs. The simplest thing is to make sure the prim has the right creator. (I suspect that's how the other system's script knew to delete the new prim into which it was copied.) But of course any old copy+mod prim by the right creator would defeat that. Other methods are more complex.

Anyway, yeah, there are sort of two different things going on here that combined in a really unfortunate way. Firstly, there's some sort of exploit of the voucher system itself, such that a single voucher (or copies of it) is satisfying multiple purchases; that's a problem whether or not a discount applies. Secondly, there's a disconnect between voucher redemption and discount, such that the discount must apply to vouchers as well as cash payments; that's not necessarily a problem by itself, but makes the exploit especially costly. (In this particular case, it was the only real cost because the voucher was redeemed for many copies of an item that was copy-perm anyway.)

I read through this forum a bit. I'm not exactly sure how that voucher system works, but in my opinion a script should never give money unless it was actually paid money (triggering the money event).

I have developed a system that is very secure. I have a free demo that I can set to expire within a few days. If you like, contact me in world.

CDru

Ok now I get it! The 10% off was in cash! Didnt get that. Ignore my earlier post. Im so sorry this happened to you. Ppl take all chanses...

You are not dumb for being kind Yummy. You are kind for being kind.
Challenges with complex executions of programs plague all businesses.

Have a read of the "OR ..." paragraph in my post above yours. Until Yumi tells us otherwise, I'm favouring that explanation at the moment - just a feeling.

[added]
Since it's the script in the voucher that holds the amount remaining (I hadn't thought of that), and I'm assuming that the seller can't modify the script or they'd be able to reproduce their own, then I'm favouring that explanation even more - that the group discount system isn't dependant on a positive response from the Hippo voucher system (script), and just recognises a sale and gives the discount, regardless of whether or not the voucher script accepts the sale.

As do those who will exploit them for their own purposes.

Sorry this happened to you

Yes, but I'm having difficulty believing that the discount-giving logic would be written to work without positive confirmation that at least the central product-giving system believed a transaction had occurred. Something has to trigger the discount-refunding logic, of course; I guess theoretically in the case of cash it could be the money() event itself, but in the case of a voucher, could it really be just a touch event in the presence of a (possibly dead) voucher? That seems too obvious a bug, and one that I'd expect to be exploited (and hence, caught) sooner than this. But maybe.

It certainly raises the question of whether transaction history really shows delivery of all those outfits.

If they really did get delivered, then something else happened. Perhaps some logic flaw or race condition that is interfering with deducting the value of the purchase from the voucher (as your first paragraph hypothesizes), or some means by which the voucher itself is being copied script and all (such brute force exploits have existed and may still be possible for all I know).

It's interesting that there were three accounts involved. The more accounts doing transactions, the more RL vulnerability for the perpetrator(s). Seems likely that either the exploit itself required multiple participants to trigger some logic defect, or that it was just some extreme glitch that one "accidental" thief shared with friends.

The 3 people were buying at different times. The 2nd one was 20 hours after the first, and the 3rd was less than a hour after the 2nd. So it doesn't look like it needed multiple participants. It looks more like word of mouth - "Have this voucher and go and do what I did with it."

Yumi said that the group discount system had been on the go before the voucher system was added. The question in my mind is, how does it operate - how does it recognise a sale? The money() event handler would have dealt with it previously, but how is it triggered now?

I read the Hippo feature pages about their vendors and vouchers, but not the detailed pages, and nothing was mentioned about group discounts. Do their vendors have a group discount option, or can they send a linked message about the result of an attempted purchase? If they do either of those, and one has been implemented (and acted on, in the case of a linked message), then my idea is mistaken, but if they don't, how does the group discount kick in?

Or a single person with a few alts.



It might have been one voucher used over and over, and therefore the server is not figuring the balance correctly. However, it is also possible that the script inside the voucher did not get the perms properly changed and the person copied that script into other objects and therefore was able to basically create many many copies of the voucher. This would mean that each sale was using a new distinct voucher.




A few of my groups give group discounts. However, they do not use vendors, but instead use individual "for sale" objects that use a script and the Pay function, therefore they have a money triggering event.

In reading about the basic Hippo vendors, they can be set to offer a group discount. Therefore, that process should be integrated with the process that offers the ability to purchase via a voucher/giftcard and not give the discount back in that instance. This part sounds like a flaw/bug in the Hippo vendor itself as it relates to the group discount script. If that is correct, then I would definitely talk to the Hippo vendor creator about that part.

http://www.xstreetsl.com/modules.php?name=Marketplace&file=item&ItemID=222475

"Vendors can be set to offer a discount to a group."

I see it. I thought I was onto something too

TY Charlie, Id like more info on that.