How I Beat CryptoKitties

Rob Durst
Rob Durst
Apr 2, 2018 · 5 min read

In light of CryptoKitties’s $12 million funding round and in celebration of selling my last cat for 2 ETH, here is the story of how I beat CryptoKitties.

The Beginning

I was one of the lucky people who came across a Twitch livestream a few days before CryptoKitties experienced exponential growth:

Image for post
Image for post

And just as the game took off and ETH flowed in like crazy, I bred a shipcat, a Fancy cat for those less experienced CryptoKitties breeders. At the time, this was the 120th shipcat bred and one of only 35 on the market. It looked a bit like this:

Image for post
Image for post

Well, this cat ended up selling for 0.83 ETH and within a few days I had made over $1000 on a $50 investment.

2 is Better Than 1

That weekend I came home — I live in SF and my parents live an hour away. After telling my dad about the craziness of CryptoKitties, I went to the grocery store with my mom to pick up a couple things. We come back less than an hour later and my dad had installed MetaMask, setup a Coinbase account, and purchased his first CryptoKitty (before this, cryptocurrency was just funny money and CryptoKitties “one of the most ridiculous things he had ever heard of”).

Yep… Cryptokitties was my father’s introduction to cryptocurrency.

One Month Later

As apparent from the graph above, the Cryptokitties craze did not last very long. Most people, like myself, made some ETH and cashed out. However, my father still had a few cats left and with the market looking bearish, he was looking for new ways to sell his cats — from the subreddit to the discord channel to Steemit.

Coming home one weekend, I decided to help my dad sell his remaining cats. After a few hours of brainstorming and hacking around, we came up with a plan.

Hacking CryptoKitties (well, sort of)

Since I had quit Cryptokitties, a few new features had been released. One particular feature, likes, was a little shaky in it implementation — it was exploited only days after its creation.

However, the average Cryptokitties user is not very tech saavy, so most of the like exploits were simply people creating multiple accounts on MetaMask and liking up their own cat. While this is effective for maybe 10–100 likes, it gets very time consuming when done in large quantities.

Having had some experience with web3.js I sought to repeat this liking process, but with code. Here is the end result (this is a cat with an absurd number of likes):

Image for post
Image for post

The Code

Here is a walkthrough of the “hack”:

  1. Generate a public/private keypair.

This is what it looks like in code:

const web3 = require(“web3”)
const Web3 = new web3(‘ws://localhost:8546’);
const axios = require(“axios”);
async function hackTheCats(address, signature, origin, catid) {
try {
const response = await axios({
method: “post”,
url: “https://api.cryptokitties.co/sign",
data: {
sign: signature.signature,
address: address.toLowerCase()
},
headers: {
“Content-Type”: “application/json;charset=UTF-8”,
Referer: “https://www.cryptokitties.co/sign-in",
}
})

const response2 = await axios({
method: “post”,
url: “https://api.cryptokitties.co/kitties/"+catid+"/purr",
headers: {
Authorization: response.data.token,
}
})

console.log(response2.data.purred);

} catch(err) {
console.log(err);
}
}
function loopTheHack(n, catid) {
for (var i = 0; i < n; i ++) {
const account = Web3.eth.accounts.create();
const address = account.address;
const signature = account.sign(“Cryptokitties”);
hackTheCats(address, signature, i, catid);
}
}

Success!

One major drawback of games like CryptoKitties is the search-ability of your digital assets — how easy is it for others to find the asset you are trying to sell. Lucky for me, likes was one of the filters provided in the CryptoKitties marketplace. Since I was the only one programmatically liking cats, I was easily able to dominate the marketplace. My strategy?

  1. Like a cat until it is the most liked cat on the market

Here are the two accounts I was using:
* 0x97b2f877098B9ff46B86650290B13f85881fC9E5
* 0x4Cfc6cdA90a0D338B99bFD35A4d75Fa97bFD17e4

You can see how much I made here: https://kittyrush.herokuapp.com/

Here are some of the cats I sold:

Image for post
Image for post

And of course, with 240,000+ likes, the most liked cat in the game:

Image for post
Image for post

Can I Use this Hack?

No, (un)fortunately the CryptoKitties dev team has covered up this exploit, allowing only those with at least one cat to like other cats. This means, to replicate the above, you would need to pass a cat back and forth between accounts — by the time you get to 20,000+ likes, the $$$ you spend on gas would be more than you could possibly make from a liked up cat.

Takeaways

With real money on the line, even the most ridiculous crypto games are targets for hacks/exploits. However, I would argue that crypto games are even more vulnerable to such exploits because the average online crypto gamer is an easier target than a USD gamer:

  1. Transactions are final (once the money is sent, it is gone)

So if you decide to engage in a crypto game, watch out! It truly is the wild west out there.

HackerNoon.com

#BlackLivesMatter

Sign up for Get Better Tech Emails via HackerNoon.com

By HackerNoon.com

how hackers start their afternoons. the real shit is on hackernoon.com. Take a look

By signing up, you will create a Medium account if you don’t already have one. Review our Privacy Policy for more information about our privacy practices.

Check your inbox
Medium sent you an email at to complete your subscription.

Rob Durst

Written by

Rob Durst

Lumenaut. Mule. Software Engineer.

HackerNoon.com

Elijah McClain, George Floyd, Eric Garner, Breonna Taylor, Ahmaud Arbery, Michael Brown, Oscar Grant, Atatiana Jefferson, Tamir Rice, Bettie Jones, Botham Jean

Rob Durst

Written by

Rob Durst

Lumenaut. Mule. Software Engineer.

HackerNoon.com

Elijah McClain, George Floyd, Eric Garner, Breonna Taylor, Ahmaud Arbery, Michael Brown, Oscar Grant, Atatiana Jefferson, Tamir Rice, Bettie Jones, Botham Jean

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch

Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore

Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store