Group transfer exploit

[wernt101 (Honeypot2)]

This post provides a video that summarises the problem.

Henry (@dryw3st) on X

Essentially, there is an exploit in Roblox that allows anyone to claim ownership of a group when it’s undergoing a transfer of ownership.

This is a critical issue with the platform as it brings the risk of large groups and games being lost from the platform.

An example of this happening can be found to this group: Newton Science Incorporated - Roblox
where an owner transfer was initiated by this account:
decaysoftworks - Roblox
Intending to transfer ownership to:
Hazardous - Roblox
and ended up going to this unauthorised account:
Beat it - Roblox

Expected behavior

Unauthorised accounts should not be able to claim ownership of groups.

Edit:
Please refer to the following post for further information!

[Group Vulnerability] Legitimate ownership transfer causes group ownership to be reset, allowing bots to claim the group

A friend of mine lost ownership of multiple groups after Roblox automatically reset their ownership, leaving them available to be claimed by other accounts. This happened shortly after he legitimately transferred the groups from one account he owned to another account that he also owned. Roblox’s automated systems appear to have incorrectly flagged these transfers as fraudulent and removed the new owner. Once the groups became ownerless, automated bots quickly claimed them, resulting in the grou…

[di_VIbilDev (princess)]

The source that you provided (Twitter post) seems unreliable, as they do not properly report this, and instead spread misinformation across the internet. What may have caused the ownership change to a bot (just a theory, I might be wrong) is that between transfers the group could have been ownerless for a while or the owner simply left the group, letting bots that claim groups without owners to claim it. These bots existed for quite a while now, and I’m not sure whether Roblox can find a solution or not.

UPD: I have seen more bug reports about this, so it might be something else.

[VelvDEV (Velv)]

[Group Vulnerability] Legitimate ownership transfer causes group ownership to be reset, allowing bots to claim the group

A friend of mine lost ownership of multiple groups after Roblox automatically reset their ownership, leaving them available to be claimed by other accounts. This happened shortly after he legitimately transferred the groups from one account he owned to another account that he also owned. Roblox’s automated systems appear to have incorrectly flagged these transfers as fraudulent and removed the new owner. Once the groups became ownerless, automated bots quickly claimed them, resulting in the grou…

I have already provided a detailed account of what happened to a friend of mine. Please refer to my post for further information.

This exploit is real, highly harmful, and should be investigated as soon as possible.

[wernt101 (Honeypot2)]

Hi, thank you for sharing your post. Apologies for not seeing it earlier!

[Bobbifiy (Bobw)]

[lm_gameon (gameon)]

Hello @wernt101 , the ownership of the group mentioned has been fixed. Please refer to this message for more details.

We take these kind of issues very seriously, and we’ll take rigorous steps internally to do a retrospective on this and add additional hardening so that bugs like this do not reoccur in the future. Thank you, and we sincerely apologize for this issue.

[wernt101 (Honeypot2)]

Hello, thank you so much for returning the ownership, really appreciate your effort here!