THEORDER

Follow-up security & stability pass. No client update required.

🔴 Crash Fixes

🟠 Teleporter out-of-bounds crash

A crafted teleporter request with a negative index read past the destination list — garbage teleport, or a world-server crash on a large negative value. Now bounds-checked on both ends.

-# Impact: one packet at a teleporter NPC could take down a channel.

💰 Cash Shop Fixes

🔴 Point loss on concurrent top-up (real money)

Purchases overwrote the whole balance instead of subtracting, so a website credit that landed at the same moment was silently lost. Switched to an atomic database deduction — a concurrent top-up can no longer be eaten, and you can't overspend.

-# Impact: real money/points could vanish on a rare timing overlap.

🟠 Purchase spam throttling

Cash-shop buys now count as "expensive" in the packet rate limiter, so a modified client can no longer flood the buy handler and hammer the database worker.

🟡 Gift to invalid recipient

The shop accepted any character id — a fake id meant the buyer paid and the item vanished into nowhere. The recipient must now be a real character (any character; no friends requirement).

🔴 Full channel crash via malformed sell packet

A crafted Quick-Sell packet could instantly crash a world server and disconnect everyone on the channel. A signed/unsigned bug let a bogus item count slip past validation and trigger a multi-GB allocation. Fixed.

🔴 World server crash via forged packet size

The server trusted the client's packet-size field with no upper bound — a single packet claiming up to 4 GB crashed it outright. Now capped at 64 KB; oversized/wrapped values are dropped and logged.

🟠 Memory corruption in the login handshake

A modified client could overflow a fixed 42-byte buffer during the encrypted-password step of login. The buffer is now always safely terminated; normal passwords are unaffected. Fixed.

⚡ Server Stability & Performance

🟠 Server-wide lag storms from request spam

Shop Search, Party Finder, Record Book, mailbox & more rebuilt huge responses on every call with no cooldown — a modified client could spam them into channel-wide lag. Added a per-connection cost budget at the central packet gate: cheap actions cost almost nothing, expensive requests cost more, spam gets dropped, sustained abuse disconnects.

-# Impact: throttled from thousands/sec down to a handful; normal play never hits the limit.

🔧 Under the Hood

🟢 One gate instead of a hundred patches — the rate limiter sits where every packet passes, covering all packet types at once (including future handlers). All rejections logged for tuning.

⚪ Verified existing defenses — full network-layer audit confirmed the checksum, size cap and connection-flood guard on public listeners are active. Two earlier "missing protection" reports turned out to be false alarms.

📋 Known & Deferred

• Response caching (Shop/Party): deferred — the rate limiter already neutralizes the abuse.
• Two latent deserialization limits: server-to-server only, not client-reachable. Low priority.