/nvending-monday-exploit

☕ An overly detailed and somewhat deranged report of an infamous NVending malfunction incident.

nvending-monday-exploit

On March 25, one of the new NVending vending machines at the Porto University's Faculty of Engineering malfunctioned, effectively performing what could be described as the world's first unintentional vending machine sale, featuring 55% discounts on the machine's whole range of products.

The rumour

The initial rumour was that "a vending machine at the end of the university's B hall was giving money away".
Ever since the university's switch in distributor, NVending have had their fair share of outrage. Higher prices and poor maintenance are just some of the arguments found in this petition-like Facebook group signed by over a thousand students, demanding the old distributor Super 2000 back.
Now, I'm not much of a religious guy to believe in multiplication miracles, so I had to try it out myself.

The experiment

After a little experimentation, we found the machine's perceived value of each coin inserted was being multiplied by 2.2x. For instance, if we were to insert 10¢, the display would show 2.2*10=22¢.

The refund button

Unfortunately, pushing the refund button doesn't double the money you inserted, it just returns you the same coins.
In our understanding, after the coins pass the scanner, they're inside this closed circuit where no recounting is needed until a product is dispensed and refunding is no longer possible. This maybe prevents scanner misreads (like these) to be exploited. I'm not going to pretend I have any understanding of how these contraptions work.

The empty slot selection

Could we break this closed circuit by selecting an unavailable product? Not really, as the sensors at the bottom of the machine do detect whether the product was dispensed. So the mechanism can't be tricked to refund the perceived (doubled) balance.

The change normalization

Well, you could still argue you could just pump the machine full of cash, purchase something really cheap and then get a fortune worth of change. What we uncovered is that the change is also divided by the very same factor of 2.2!
For example, if the (augmented) change due is 55¢, the machine is smart and will just give you a portion - 25¢ in fact.

The invalid change

Every calculation on the machine is a multiple of 5 so it rejects 1 and 2 cent coins. Yet by multiplying by 2.2 you're breaking that very rule (e.g. by inserting 5 cents, you'll end up with 11). Presented with the scenario of non-multiple of 5 change due, how does it behave?
If the fraction can be rounded up to a multiple of five (e.g. 0.745€ ~ 0.75€), it'll work. If not (e.g. 0.73€), sadly NVending machines aren't equipped with coin-sawing blades so it just gives up altogether.

The math behind all of this

Now for the part where you may start realizing I have spent an unhealthy amount of time figuring this out.
Imagine we purchase the most affordable product on the machine, a bottle of water totaling 55¢.

Inserted balance Perceived balance Perceived change Actual change Cash spent
0.50€ 1.10€ 0.55€ 0.25€ 0.25€
0.60€ 1.32€ 0.77€ 0.35€ 0.25€
0.65€ 1.43€ 0.88€ 0.40€ 0.25€
1.00€ 2.20€ 1.65€ 0.75€ 0.25€

Regardless of the amount you insert, the cash spent remains constant. This might or might not seem apparent from the get-go, but the actual discount you get is simply that very same 2.2 factor applied to the product's cost.

Dividing by 2.2x is the same as multiplying by around 0.45, meaning you are discounted by 55% on every transaction, assuming you receive full due change.

The invalid change avoidance

Every transaction running on this bug follows the formula above. To ensure all due change is returned, it's crucial to ensure its value is a multiple of 5. This means one of the following must occur:

  • The product cost's division by 2.2 results on a multiple of 5;
  • If not, the change due must round up to a multiple of 5.

I couldn't be bothered enough to calculate on which scenarios the latter happens, I think we both could agree this repository displays my slow descent into madness enough.

The silver lining

Even if you cannot empty the machine's figurative pockets, you can still benefit from a 55% discount on every over-sweetened product on the machine! That is, until the guy who refills the machine realizes the machine's empty for once and made a fuckton less than expected.

On that same monday, a NVending coffee machine stole 50 cents from me. I like to think this document is some type of badass revenge yet I've spent three hours writing this. In retrospect, NVending won twice that day.

Stay nourished, friends.

Written by Miguel Mano.
Experimentation by Julieta Frade and Miguel Mano.