Set opts.ranked on real ranked queue attempts - #2
Merged
Conversation
MPAPI.matchmaking.queue()'s launcher-anti-cheat gate only runs when the caller explicitly passes ranked=true or lobby_type=RANKED - it has no way to infer that from the game_mode string's "ranked:" prefix alone (see that function's own doc comment). _join_queue() never set it, so the client-side gate silently never ran for any real ranked SPDRN queue attempt - a no-op layer of defense-in-depth, not a working one. The server-side launcher-integrity gate was unaffected either way (it's independent, keyed off the game_mode prefix directly), so this was never an actual bypass - just a missing client-side check that should have been running.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
`MPAPI.matchmaking.queue()`'s launcher-anti-cheat gate only runs when the caller explicitly passes `ranked=true` or `lobby_type=RANKED` - it can't infer ranked-ness from the `game_mode` string's `ranked:` prefix alone (see that function's own doc comment in BalatroMultiplayerAPI). `SPDRN._join_queue()` never set it, so the client-side anti-cheat gate silently never ran for any real ranked SPDRN queue attempt.
This is a defense-in-depth fix, not a security-hole fix: the server-side launcher-integrity gate (`isLauncherVerified` in `matchmaking.service.ts`) is completely independent and was never affected - it's keyed off the `game_mode` prefix directly, not anything the client self-reports. A spoofed/bypassed client still gets rejected server-side regardless of this fix. What was broken is SPDRN's own client-side pre-check silently no-opping instead of actually blocking a queue attempt when the launcher's supervision channel isn't healthy.
Verification
Found and fixed while live-testing the full launcher-integrity challenge/response round-trip this session (two launcher-supervised instances matched into a real ranked lobby against a local test server). Confirmed the fix by exercising `MPAPI.matchmaking.queue({ranked=true, ...})`'s gate directly and observing it correctly refuse to queue when the loopback supervision channel wasn't active.
🤖 Generated with Claude Code