Time to revive the blog? I have stayed in “that thread” over at the Zwift forum for some time. Maybe I should collect the last year’s events and summarize them here before they are successfully buried in that merged thread?
I just felt I had to write an urgent post today to show a little solidarity with zwift racer Luciano Pollastri, who recently posted a report in a blog on an exploit in the Zwift Companion app likely being used extensively in racing. The report is quite similar to exploit reports within IT security, a common way to draw attention to and raise concern over threats to integrity in some system or other. In this case Zwift racing. It’s how you make zero day yesterday. It’s helping. Only Zwift didn’t see it that way.
Yapping the #freeluciano meme spreading over at the forum, like some Instagram diva who wants to follow in the general direction of the winds and get a completely safe share of the spotlight, does absolutely nothing for Luciano, who got suspended by Zwift for helping them find the exploit and who was also forced to delete the report from the blog. (According to Zwift he should have whispered in their ear instead of posting that report and then waited a few months or maybe years for them to respond zwiftly with an emergency patch, and so he was punished for his crime.)
You need to dare stick your neck out if you feel the suspension was unjust. So come on, pussies! Real solidarity in any movement is all about sitting in and sharing whatever unjust punishment that was delivered. If everyone and his mother spread his report, what can they do? Ban us all? We should at least give them the opportunity. So I’ll just… put my money where my mouth is, I guess, and be the second one to go. Here goes nothing…
Hey Zwift, I’m a criminal too, violating the ToS or PoS or whatever! You should punish me. I’ll take the suspension or ban. But while you drag me in chains to the dungeon, think about this:
Cruising is also an exploit, a way to get a repeatable unfair advantage in races. Yet you allow it. How is that conceptually any different from the exploit Luciano showed you? Accordingly, I should have been suspended years ago and you should have addressed that problem too.
Below is Luciano’s report verbatim but without some of the pics that were broken in the forbidden copy an anonymous benefactor provided me with, best I can do right, sorry:
The Ultimate Undetectable Weight Cheat on Zwift
We think we came across probably the most effective, easy, and undetectable way to cheat on races, changing your weight unnoticed during races through the companion app.
Alerted by some «strange» behaviors from some riders in certain categories, and increasing rumors pointing at people being able to change their weight during ZRL Races, we tested it.
Our conclusion is that you can actually cheat starting the race with any weight and change it during the race with the companion app as needed, depending on the profile of the race (add weight in descent, be lighter in climbs). The weight change takes effect almost immediately during the race. All apparent w/kg calculations upon arrival are made based on the last weight crossing the arrival and are apparently not detectable. Variations are unnoticeable by other riders if done properly.
We believe it is already widely exploited in competition and affects race results as some indirect conversations occur among riders. In the interest of fairness of competition, we believe such a simple and definitive way to cheat, such a substantial hack should be addressed immediately. As most races are decided on very small variations and in short time periods up to 5 minutes, this is the simplest and most effective cheat we know so far.
Fix seems simple: disable weight change feature through companion app. Though ZADA seems to have made Zwift aware of the hack, nothing has been done so far to solve the issue.
Here goes our analysis. Are we missing something?
The Protocol Agreed to Demonstrate the Hack: changing the weight during a TT and see what happens.
We did not need to go to second phase of the protocol as first test was 100% conclusive: the weight can be changed during the race through companion app and only the final weight is reflected in the different platforms.
The test: Bologna TT (Friday 18th February 10 AM CET)
We chose a TT to avoid generating draft or having an influence on the race. Also I love Bologna circuit :).
I have changed my weight from 79 to 50kg before the start of the race.
Started the race with 50kg at 200w average and then 220w, showing 3,8w/kg and 5.1 w/kg as you can see in the snapshots. So 50kg weight is effective on the race dynamics (Speed, etc…).
Started Bologna climb with 50kg and changed the weight from 50 to 79kg through the companion app at km 6.9.
The change of weight takes around 15 seconds to be effective. At first it seems nothing happens, but then the home trainer increases difficulty (see youtube video at 2 minutes and 55 seconds)
The weight change took a few seconds to be effective and now you can see that for way higher absolute watts the w/kg has gone down. Speed going down and HR going up.
If before weight change 200w meant 4 w/kg, now I have 3.8w/kg with 296w. Heart rate has massively gone up (dfrom 136 to 147 BPM). It is crystal clear that the weight change has been implemented. During the entire first part of the race, and specially in the climb, I was benefiting from a lighter weight.
I finish the race at 79kg. All stats upon arrival are calculated with the 79kg (see youtube video). Nobody can see the change of weight.
Same on ZwiftPower, reported weight for the race is 79kg, while I started at 50kg.
Fit file shows a substantial change in correlation speed vs power at km 6.9.
Strava also shows a dramatic change in the dynamics at 6.9km (screenshot of the bologna climb segment under)
Conclusion: in our opinion the easiest and undetectable way to cheat.
It is extremely easy to change your weight through the companion app and be lighter (or heavier in descents) through the entire race, and change it just before the arrival. As most races are decided on short efforts and differences of less than 0.5w/kg, the cheat is unnoticeable by other riders. Zwift needs to disable the weight change feature through companion app and be able to track weight changes occurring during the race.
Zwift: do something please!!! At least sticky-watters needed to train a little bit to cheat! This one feels like you left the door of the safe opened!!!
Links
Link to all snapshots taken (Google Drive folder) and fit files from Zwift Activity, Zwiftpower, and Strava in case someone feels like auditing this.