Many MMO fans will remember the Falador Massacre that struck RuneScape in June 2006. A bug with player housing gave some users the ability to attack other players in non-PvP zones, including the go-to market section of the city of Falador where players would go to sell expensive items. Cue the rampant looting. Old School RuneScape, a 2007-inspired branch of the MMO operated in parallel to mainline RuneScape, recently dodged another PvP bug with ties to player-owned housing – and while it was no massacre, it could have been a disaster.
Old School RuneScape sleuth Gudi, who hadn't been since a December 2021 video about a different PvP strategy, recently released a lengthy deep-dive on the discovery, testing, and long-delayed patching of this game-breaking bug. I'm going to distill it down as best I can, but the whole thing is worth the watch.
The short version is this: a bug with delayed damage, which was seemingly months old even at the time of discovery, could cause players to die to another player in a safe area, respawn in an unsafe area, and then take damage from an attack that was registered before their death. If this delayed damage was enough to kill you again, your second death would be treated as a PvP kill. And as Gudi observed, the ramifications of this are enormous.
When you die in an unsafe zone in OSRS, which is most of the map, you're supposed to get a grave that lets you retrieve your lost items, unless you were killed by a player. This delayed damage bug could effectively enforce PvP death rules, meaning your on-hand valuables would be awarded to your attacker through one of the loot keys which are normally reserved for getting player kills in designated PvP areas and worlds.
This is crucial because there are also safe activities that let players fight each other without actually risking any items. But with this bug, if you were killed by a player in a safe combat zone and then died to delayed damage after respawning in an unsafe area, you could lose a fortune – almost everything you were carrying – through no fault of your own.
Gudi says he noticed this bug while reviewing old footage of him getting killed by a player in the Wilderness and taking delayed damage from a boss NPC that had also been attacking him. To test the mechanics, he had to find a reliable way to deal delayed damage to other players. As luck would have it, OSRS added a powerful one in 2022: the Ancient Godsword, which has a special attack that deals 25 guaranteed damage shortly after it connects. The catch is that this effect will only trigger if you're within five tiles of your opponent, so to work with the bug, the Godsword wielder would have to be close to the victim whenever they respawned, essentially beating them back to their respawn point.
You can have up to 99 base HP in OSRS and you respawn with full health, so this delayed 25 damage wouldn't be enough to kill most players a second time. However, multiple players could theoretically stack Ancient Godsword attacks at once in a multi-combat zone to trigger the delayed damage multiple times and kill even max-HP players. This brings us to player housing, which became entangled in PvP exploits once again.
Gudi, who'd already flagged the bug with Jagex, consulted fellow OSRS expert C Engineer and landed on player housing as the ideal testbed for this bug. Player houses can include multi-combat dungeons, and when you die in one, you respawn outside the assigned house portal. This would make it easy for the attackers to be near the victim's respawn point, and it's also an environment where thousands of players regularly go to fight purely for fun, rightfully thinking their items are safe. There is a special attack limitation in player housing that prevents massive Ancient Godsword stacks, but the core mechanics could still be used to rob players of their items.
The thing is, as Gudi worked out, it's not actually dying that enables this delayed damage. Dying is just one quick way to get players from a safe area to an unsafe area via respawn. But even if the target player manually teleports to an unsafe area, the delayed damage could still trigger and kill them with PvP rules if their health was low enough.
This brings us to the safe multi-combat minigame Castle Wars, which automatically teleports all participants to a lobby area at the end of a match. Using the Ancient Godsword, four players could stack out anyone in Castle Wars just by hitting them with special attacks right as a match ended, and then claim their ill-gotten loot in the lobby.
"Of everything I had done up to this point, this was without a doubt the one which crossed the line," Gudi reasons. "I did it to a real player, and while there was no chance they would actually die because it wouldn't deal enough damage, I really did not want this bug to get leaked before it was patched."
Gudi kept the bug under wraps for a while while awaiting a response from Jagex, which did quietly patch the Ancient Godsword special attack before this video came out. But he also put it through its paces by good-naturedly luring some friends into his own in-game house to take their stuff.
With the best of intentions, Gudi convinced a few folks to enter his home at low HP – purportedly to test a bug with the iconic Dharoks armor set that increases your damage when at low health, which is actually a pretty convincing smokescreen – and then use a teleport spell right as they were hit with the Ancient Godsword. Gudi teleported right along with them to collect the loot keys. The unwitting victims wound up on the receiving end of a damage bug instead, and missing some items – which Gudi naturally returned.
The list of victims included former Jagex artist Mod Alfred, who left the Old School RuneScape development team several years ago. "You actually [killed] me in your house," a bewildered Alfred exclaims in the video. "What is Jagex doing? ... That is a really good way of luring. That's so broken. Someone could make a lot of money doing that. People could've made billions or trillions doing this."
Jagex has been alerted, as have nearly 400,000 viewers on Gudi's video, and the bug has been fixed. Ominously, Gudi teased a "potentially devastating and very similar bug" at the end of the video, so we'll see where this goes from here. But OSRS has avoided a second Falador Massacre, even if a few people did suffer bugged PvP deaths due to player housing once again.
