Skip to content

Comments

refactor: improve banking money handling to prevent potential exploit#98

Open
AlexRXWindy wants to merge 1 commit intoesx-framework:devfrom
AlexRXWindy:fix/banking-money-exploit/dev
Open

refactor: improve banking money handling to prevent potential exploit#98
AlexRXWindy wants to merge 1 commit intoesx-framework:devfrom
AlexRXWindy:fix/banking-money-exploit/dev

Conversation

@AlexRXWindy
Copy link

Description

This PR refactors and improves the money-handling logic within the ESX Banking system.
The refactor enhances both security and stability while maintaining backward compatibility with existing ESX Banking functionality.

@CLAassistant
Copy link

CLAassistant commented Nov 16, 2025

CLA assistant check
All committers have signed the CLA.

@simpleC0de
Copy link

Hey @AlexRXWindy , thanks for the PR! The idea of adding rollback logic is good, but there's a critical issue:

ESX's addAccountMoney() and removeAccountMoney() don't return boolean values - they return nil. This means your checks
like if xPlayer.removeAccountMoney('bank', amount) then will always evaluate to false, breaking all banking operations.

Suggested fix: Check balance before operations instead:

  Withdraw = function(amount, xPlayer)
      if xPlayer.getAccount('bank').money < amount then return false end
      xPlayer.removeAccountMoney('bank', amount)
      xPlayer.addAccountMoney('money', amount)
      return true
  end

Also minor: please use xPlayer.source consistently (not xPlayer.src).

Copy link

@simpleC0de simpleC0de left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See comment above - the ESX functions don't return booleans

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants