background

The Polyceon bot in Roblox Discussion already existed, it’s not brand new. It was a bit of an open secret that the original version of the bot was not very well maintained, though. A lot of features used cookie based authentication to access Roblox API endpoints. While mostly documented, those endpoints were not officially supported, and thus were prone to change at any time. Not ideal.

ok but like what is it

Since the RD server generally was focused on events and general competitveness, a lot (but not all!) of the features were very centered around Roblox. They include:

• The badge leaderboards, originally used by sending a message formatted like -badge 1986638781753490
• A few animal commands like -bird that embedded random images from Unsplash
• Commands that replaced people’s messages with webhooks, which forced them to talk in uwu speak and/or with far too many emojis we did not include these in the rewrite
• Trackers for game updates and badge owner counts (which also were not included as of writing, but may return)
• Vanity roles (icons and colors) for players who own specific badges which could be equipped at will
• Giveaways and “badge bounty” contests which had requirements to enter (that Polyceon validated), picking either random winners or the first n valid entrants to win things such as item codes or Robux

how did it work before

Pretty badly! The old version did not actually control any user account linking, it used the RoVer API to get the Roblox account a user was verified with, and required their Roblox inventory to be fully public to submit badge times or enter giveaways with badge requirements. Also, the badge leaderboard didn’t even use a proper database, it used a persistent Redis volume to store each podium. Near the end, the ratelimits for cookie-authenticated endpoints were lowered a lot, which caused issues whenever many users tried to enter a giveaway or claim a bounty at the same time.

so what did the rewrite do better

For one, it uses Discord.js instead of the fragmented (I think? That’s what glatch told me) Python Discord packages. All the commands were migrated to slash commands since Discord wants bot developers to do that now. (Except for one but you can’t use it anyways) I created an OAuth flow to allow users to actually link their account instead of using a different verification bot. As a bonus, this gave us access to scopes such as inventory-item:read which allowed us to entirely remove the public inventory requirement!!

Using the Open Cloud APIs also increased the ratelimits significantly, as Open Cloud handles ratelimits per-user as opposed to per-ip/per-account depending on if the endpoint required authentication or not. This made giveaway entries WAY more reliable, since it got overloaded quite often!

In addition, we used an actual (postgres) database for everything this time, instead of a persistent Redis volume. I’m not the most experienced with SQL, so glatch did a lot of the heavy lifting there. (read: basic setup)

wait did you actually just delete all the badge leaderboard times dating back to 2018

No, all the podium times were migrated to the new system! The old version only stored the top 3 times instead of every submitted time though, so any entries that weren’t visible on the podium at the time we shut down Polyceon V1 were lost. Old times are even marked with an asterisk to show that they are old. (and also since the timestamps for them are only accurate to the second)

It was weird to migrate them though, since they were stored in a pretty scuffed format. I was given a large JSON file with the podiums for every badge that had a podium entry. Only one entry exists for this badge, obtained at unix timestamp 1550958919. I removed his discord User ID from the image, but the badge was obtained by Feodoric.

Even with the weird format it still only took like 30 seconds to upload all the entries to the new DB though once the script was ready lmao

so how do i use this

Right now, the contest and vanity role commands are locked to RD only. The badge leaderboards, and other fun stuff aren’t, though, you can use them yourself right now!! If you want to see the quickly thrown together homepage, you can find it here

how do you cheat in a web game again

well this game looks like wasm so i should be able to use cetus and maybe learn how that works

its not wasm. also your browser has crashed lol lmao even

for some reason this game is written entirely in typescript. and it manages to nearly crash my browser (both the electron app and firefox) when i run it with devtools open. how do you even manage to do that. it spams breakpoints too but you can just disable those.

the network tab

one of the first things that caught my eye was a level up rewards json file. most of the json files were for like sprite info but this one wasnt.

can i use fiddler classic to replace this with like infinite gems when i reach level 5?

of course you can

the end lmao

the original codebase was from 2018 btw

THE DATASTORES

i don’t know where to start so i’ll mention the datastores first.= other games usually store data in tables, some even have session locking (usually via libraries such as ProfileStore or the older ProfileService)

so this game stores your data in a folder of ValueBase instances. some games do this, it’s not catastrophic yet. btw the inventory is stored as lists of literally all the item data in the game, just the ones you actually own have “Owned” set to true. btw the item ids are the index into these arrays. whioch are json encoded. into a StringValue and your actual datastore is also JSON encoded before being uploaded (roblox already does this; but converts it back to a table on load so you wouldnt notice in most cases. its bad here because it makes datastore editors treat it as a giant string)

by the way, there’s some buggy jsonencode behaviour that arises if you do such crimes

print(game.HttpService:JSONEncode({1,2,nil,nil,5})) -- [1,2,null,null,5]
print(game.HttpService:JSONEncode({1,2,nil,4})) -- [1,2,null,4]
print(game.HttpService:JSONEncode({[1]=1, [2]=2, [4]=4})) -- [1,2,null,4]
print(game.HttpService:JSONEncode({[1]=1,[2]=2,[5]=5})) -- [1,2] ????

the issues:

• no session locking so its quite easy to lose data
• also all the IDs have to be sequential otherwise youll run into issues with HttpService:JSONEncode that aren’t documented properly
• the weird jsonencode issues which cause headaches when adding items (and make it nigh impossible to remove them without hacky workarounds)

THE EVERYTHING ELSE

was just really badly structured, error-prone, and overall poorly programmed; its not that interesting to go over the other glaring issues. the datastores make up the bulk of the problems i think anyways

ill list a few other miscellaneous things that each gave me a mild aneurysm though, in no particular order

• the chair model is scaled at 0.001 (and so are a lot of the chair skins)
• cosmetics have inconsistent and often broken hierarchy structures
• simple custom gamemodes manage to be very confusing to read – comments be damned

THE FIXING

now it uses rojo and git instead of just roblox studio. that doesnt make the programming instantly better it just makes it nicer to work with imo. EVERYTHING WAS REWRITTEN UNDER THE HOOD. EVERYTHING. we went scorched earth with it. user data now uses ProfileStore so we have session locking, and dataloss is mitigated !! most importantly, THE STRINGVALUES ARE NO MORE!!!!!!!!!!!!!!!!!

so now what

the rewrite not actually finished yet as of now. but like we have lives sooooooooooooo yeah.

in short, i saw a modified version of the Reverie theme on pwoofy.me and thought it looked cool. sooooooooooo i forked the original and started changing it ^-^

rn i ended with like a larp hackerman style solely because i think its funny. maybe ill add like a glitch text effect as text scrolls off screen or smth idk

dont expect to see much of anything here soon.