Bug/Exploit: Mantling Through Tiny Holes

[sullium]

Hi, I was playing my map and found that I could mantle straight through a gate onto some nearby stairs, as long as I was aiming through a gap in the gate's bars.

Through testing I've found that I can mantle through incredibly small gaps, like this 2x2 unit hole in a 3-unit-thick wall of solid worldspawn (see video):

 

Thicker walls seem to reduce the problem but not remove it: This 22-unit gap in an 8-unit-thick wall is too thin to walk through, but a well-aimed mantle gets me past it (see video):

 

I should note that the positioning is a bit particular, moving the hole or the target platform by a few units can make it harder or impossible to pass through by mantling.

In both cases above, I can simply stand still and tap the mantle key or hold the jump key to climb through. Moving or leaning in certain ways could help to perform the exploit in practice, but the core issue seems to be a bug/oversight in mantling in general.

I tested this in TDM 2.13 on two different Windows 11 PCs.

If you're curious, both of the simple test maps seen above are attached to this post. The player is already in position on map start, just tap mantle or hold jump. (The second map is a bit precise, if you have trouble try binding a keyboard key to Attack so you can start the map without jostling the mouse. Or just spam mantle, it's not pixel-perfect or anything.)

mt.map mt2.map

Edited February 2 by sullium

[I.C.H.I.]

I never looked at TDM's source code but something like this usually happens when ray-cast is used instead of shape-cast.

[STiFU]

14 hours ago, sullium said:

Hi, I was playing my map and found that I could mantle straight through a gate onto some nearby stairs, as long as I was aiming through a gap in the gate's bars.

Through testing I've found that I can mantle through incredibly small gaps, like this 2x2 unit hole in a 3-unit-thick wall of solid worldspawn (see video):

 

Thicker walls seem to reduce the problem but not remove it: This 22-unit gap in an 8-unit-thick wall is too thin to walk through, but a well-aimed mantle gets me past it (see video):

 

I should note that the positioning is a bit particular, moving the hole or the target platform by a few units can make it harder or impossible to pass through by mantling.

In both cases above, I can simply stand still and tap the mantle key or hold the jump key to climb through. Moving or leaning in certain ways could help to perform the exploit in practice, but the core issue seems to be a bug/oversight in mantling in general.

I tested this in TDM 2.13 on two different Windows 11 PCs.

If you're curious, both of the simple test maps seen above are attached to this post. The player is already in position on map start, just tap mantle or hold jump. (The second map is a bit precise, if you have trouble try binding a keyboard key to Attack so you can start the map without jostling the mouse. Or just spam mantle, it's not pixel-perfect or anything.)

mt.map 7.63 kB · 0 downloads mt2.map 6.11 kB · 0 downloads

Haha, that's a nice bug. When checking for mantling options, we are checking the player collision model only at the target location, so that explains this bug. It won't be easy to fix so this will not get into the currently running 2.14 beta anymore. I have added created a bugtracker entry for this. Thanks for the report.

 

[sullium]

4 hours ago, STiFU said:

It won't be easy to fix so this will not get into the currently running 2.14 beta anymore.

Fair enough! Makes sense to take the time and make sure any fix doesn't break existing missions and such.

There's something else weird I noticed here: filling in the hole itself with 'clip' or 'playerclip' (as shown below) doesn't block the mantle, I can still climb through.

Filling the hole with nodrawsolid instead does block the mantle as I would expect.

Further, if I make the whole wall out of clip or playerclip with no hole in it then I can still mantle onto the platform from the other side of the wall, from many angles. My impression is that the mantle "raycast" goes straight through these clip brushes, although the check for space at the target location does seem to account for any clip brushes there.

Does this seem like an issue too? Or maybe it only looks like one in combination with the collision checking issue already established?