Is this exploitable?

gave me in idea never tested kinda like a dupe/transfer theory Have a random char stand with an item inv the in a spot then get a second char and make him spam click on where the loot would apear then get the first char to drop it maybe get some results?

I'm not sure it'd work. You'd probably have to edit some code or something, or send some packets.

not possible.
I tried this in USW server, a guy was dropping items, and i was using my AHK script that sends 10 clicks at one press of a button. didnt get a single item. infact, i didnt even see the items being dropped.

It is supposedly caused by lag, and your AHK script would not work for sure.. I tried mine with about 10,000 clicks/s and failed. I'd try messing with packet editing.

I have tested this.

It does not work. The server knows the item is soulbound.

When pet drops were released, I tried this after oryx1 with an extra pet i picked up. I had about 10 people standing on me for at least 5 minutes while I repeatedly dropped the soulbound pet. No one claimed to have gotten it and I eventually just let it disappear on the ground. They tell me they could see it nearly every drop though.

I just verified it with objectType <Object type="1283" Class="Container" Size="80" SlotTypes="0, 0, 0, 0, 0, 0, 0, 0" id="Soulbound Loot Bag">

The server does report soulbound loot bags within the UPDATE packet _but_ it does not report the actual content of the bag (which it does for normal loot bags and all player's inventory). Either this is in order to trigger a loot-drop-sound at all clients or a design flaw ...

So you can not exploit this ... you would have to guess the actual objectType of the item in the bag and even then the server would most likely give you a negative invswap result ...

thanks for researching this

ok just to complete this ... you can not exploit this EVEN IF you guess the objectType within the bag correctly ... you just get negative INV_SWAP results ...

[RECEIVED] 9 4 (INV_RESULT) data:-1 direction:1

---------- Post added at 03:16 PM ---------- Previous post was at 03:13 PM ----------

and it has nothing to do with speed or the amount of clicks ... i have verified this on a packet level ... my programmatic client just sends INV_SWAP at the moment it receives the forked UPDATE packet ... i.e. i injected the right objectType into the first slot of the loot bag ...

$objectStatsValue=3121 if($objectStatsId==8 && $objectType==1283);

---------- Post added at 03:17 PM ---------- Previous post was at 03:16 PM ----------

but it would not have surprised me if this was exploitable ... the engineers seem to be rather unskilled when it comes to proper/secure design as you can see with the race condition that led to duping ...

I've tried it and sometimes you'll here the error sound. not possible.