MY address:sug8s76HHjT8j6FAP3XGVGgwGwngsW4dyktKdsxDzPgUVUpE7
Operator # 64
I don’t think it’s my problem. It should be a bug. I have put in a lot of practice. Continuously test various bugs and report them. Can I receive mainnet rewards?
Reporting bugs is not currently incentivised.
If this bug that generates multiple tokens is not reported. Reports do not receive rewards either. So would you encourage me to wait for the mainnet to go live. Secretly exploit this loophole again? And not telling anyone else
Initial feedback from the engineers suggests this is a UI bug rather than a protocol exploit:
It is related to issue #3459 but it seems the issue is not triggered since the unlock has succeeded.
It seems like a front-end issue. From the screenshot the user provided, he has requested to unlock 100 tAI3 for operator 64 at block #1858099. But from polkadot.js, it shows the user has requested to unlock 100 tAI3 for both operators 62 and 63 (so 200 tAI3 in total), but there is no unlock for operator 64.
Also, I saw the screenshot showing the unlock happened on 1858099-23 but this block only has 20 extrinsic, so it may be possible that the front-end is showing the data of a block in a stale fork. Or may be just showing the wrong data out of nowhere.
There are a number of known issues with Astral that are being actively worked on at the moment. It is one of the reasons we have not kicked Stage 1 of Game of Domains off yet.
We take protocol security very seriously and are partnering with Immunefi for a mainnet bug bounty program
The root cause is located, which is Astral is showing the data of a stale block (in a stale fork).
In the best fork, the unlock of operator 64 in block #1858099 does not happen (you can query via polkadot.js), and overall are expected on the protocol side.
More details:
This is more likely the issue, I checked again with astral when querying block #1858099, it does return a block that contains the unlock request of operator 64, this block is also available in polkdadot.js if we query by the block hash.
But when a query with the block number (which always returns the block of the best fork) polkadot.js returns another block that doesn’t contain the unlock of operator 64.