Well-known dataminer Aquaismissing has been rewarded by Valve for finding and reporting a bug that allows you to preview case skins not yet released in CS2. In 2023, he received $750 USD for doing so. He recently revealed this fact in his live stream.
Aqua reported the issue on the HackerOne platform in April 2023. The bug was categorized as medium severity. Valve did not respond to the dataminer's report until a month later, in early May. The bug was that any user could see future skins by simply setting themselves to "admin" in the view queue, allowing them to receive information about new skins before their official release.
I have whined enough, the exploit has been FINALLY fixed!
— Aquarius 🛹 (@aquaismissing) June 26, 2024
Now I can reveal how it worked: you could generate Workshop queues with admin tags, even tho these tags are completely hidden.
Here's an example of a queue with A1-S + admin tag right before the Kilowatt Case dropped: https://t.co/7MH2TYT9WP pic.twitter.com/gurWRkbepS
More recently, Valve fixed this issue by securing data about new skins. This incident demonstrated the importance of the dataminer community and their role in keeping games safe.
The Aquaismissing incident underscores how important interaction and collaboration between players and developers is in identifying and fixing vulnerabilities, contributing to the overall quality of games.
Source: X
Comments