Gamepasses are now spoofable via regional pricing

[polipiolypus (poli)]

When users sell their own game passes in our experience Clip It they can use regional pricing to completely bypass all of our exploit checks. This allows for malicious users to completely bypass any checks against pricing changes for donation systems.

We check against https://apis.roblox.com/game-passes/v1/game-passes/{asset-id}/product-info to confirm users have not updated or changed the pricing of a game pass when it is purchased.

The current workaround is using https://apis.roblox.com/game-passes/v1/game-passes/{asset-id}/details and checking if it has a ‘RegionalPricing’ flag in the ‘enabledFeatures’ array, and ignoring gamepasses that have this attribute.

Expected behavior

Roblox APIs should return the accurate value, or allow for developers to predictably determine what users actually pay for game passes.

A private message is associated with this bug report

[starhiker13]

Thank you for reaching out. Our team is actively looking into this issue.

[bvetterdays (roman)]

This was reported 3 other times:

New Vulnerability Affecting Donation Games

Due to the newest regional pricing update, players are now able to purchase gamepasses at a lower price than what is stated. The game thinks the player purchased at the highest price, and therefore creates inaccurate stats. Expected behavior Some sort of metadata stating if the gamepass that was purchased was using regional pricing at the time of purchase. Or even better, a receipt callback for gamepasses stating how much the player paid for the pass, just like for dev products. A private mes…

Players able to test regional pricing of their gamepasses outside of their experience

Roblox recently released a new feature “Localized Pricing” but that came with a serious bug! The Bug So you can test the regional pricing of your gamepasses using the Dynamic Price Check feature, but the thing is that it’s not limited to the game in which the gamepass resides under where it states in the page that its meant for "your Roblox experience" [image] Many roblox games have been impacted by this bug including the well known Pls Donate where they had to disable global events as you c…

Critical Exploit via Regional Pricing Allows Gamepasses Product Abuse

A recently discovered exploit allows users to bypass intended gamepass and avatar item pricing within experiences by leveraging regional pricing differences. This is combined with test accounts added through the user’s own experience, where the passes are hosted. The exploit manipulates the perceived transaction amount, creating major discrepancies between what developers expect a user to pay and what is actually paid. [image] This bug severely impacts developers who rely on item sales for mon…

Not sure why this is the one being addressed. I kindly request you go through older bug reports that may have been filed overnight rather than just picking the ones you see at the top of the category to forward to engineers.

The other threads also contain more helpful info.

[igotyour (Lexie)]

Super easy to fix but yes its a issue

[DeveloperBugReports]

This issue has been fixed!

[eddmxn (edd)]

What is this fix exactly? Does it just not allow passes with regional pricing enabled to be purchased in these games?

[bvetterdays (roman)]

A huge thank you to the engineer(s) who worked so quickly to resolve this. Around 9PM EST, the patch was rolled out and we stopped receiving reports of this exploit being abused.

The patch prevents these gamepasses from being purchased in any experience other than the one they are directly associated with.

Much appreciated.