Describe the bug
There is a logical vulnerability in the gamification engine that allows users to farm infinite Dev Points. The determineBadges function recalculates earned badges entirely from scratch based on the user's current profile state (e.g., bio length, linked social accounts). It does not preserve most previously earned badges. If a user deletes their bio, they "lose" the profile-perfect badge. When they re-add their bio, the backend views it as a "newly unlocked" badge and awards them XP again.
To Reproduce
Steps to reproduce the behavior:
- Go to your Profile Settings.
- Fill out your Name, Bio, Photo, and Role to unlock the
profile-perfect badge and earn XP.
- Delete your Bio and click Save.
- Re-enter your Bio and click Save.
- See error: You are re-awarded the
profile-perfect badge and granted duplicate XP. Repeat to farm infinite points.
Expected behavior
Badges should be permanent once unlocked. Deleting profile data should not revoke the badge from the earned list, and re-adding the data should not trigger a duplicate XP grant.
Screenshots
N/A
Desktop (please complete the following information):
- OS: All
- Browser: All
- Version: Latest
Smartphone (please complete the following information):
- Device: All
- OS: All
- Browser: All
Additional context
File affected: src/lib/point-calculation.ts. The determineBadges function should cross-reference the user's existing achievements array and ensure that existing badges are preserved in the returned array.
Describe the bug
There is a logical vulnerability in the gamification engine that allows users to farm infinite Dev Points. The
determineBadgesfunction recalculates earned badges entirely from scratch based on the user's current profile state (e.g., bio length, linked social accounts). It does not preserve most previously earned badges. If a user deletes their bio, they "lose" theprofile-perfectbadge. When they re-add their bio, the backend views it as a "newly unlocked" badge and awards them XP again.To Reproduce
Steps to reproduce the behavior:
profile-perfectbadge and earn XP.profile-perfectbadge and granted duplicate XP. Repeat to farm infinite points.Expected behavior
Badges should be permanent once unlocked. Deleting profile data should not revoke the badge from the
earnedlist, and re-adding the data should not trigger a duplicate XP grant.Screenshots
N/A
Desktop (please complete the following information):
Smartphone (please complete the following information):
Additional context
File affected:
src/lib/point-calculation.ts. ThedetermineBadgesfunction should cross-reference the user's existingachievementsarray and ensure that existing badges are preserved in the returned array.