[Bug report] Power enforced hardware requirement does not function as intended

@xflintx Starting a bug report on this issue, which I encountered about ten days ago after having some suspicions when looking at race results. I hope this is the right place and means to report, as I could not find an alternative when I did a quick google search. I will first provide a bit of background, and a reproducible step-by-step example to demonstrate the threads’ claim.

Zwift seems to have transitioned from a time when riders would be banned for illegitimately unlocking virtual bikes (eSports level, I know, but still), to a time where all sorts of equipment are welcomed to roam around in Watopia, join group rides and low-profile race events. This is great from a fitness and accessibility perspective so I can understand, and even support, this shift. To keep at least some races as credible bike races, organisers were handed the option to enforce “Heart rate” and “Power” hardware requirements in (race) events. The intention of this was to:

“(…) create a race environment where you know that the Zwifters you see around you are on hardware that is accurate and displaying power to a level similar to your own.” (…) “Equipment like spin bikes with or without power meters - e.g., Schwinn IC8 - or classic trainers being used with a speed sensor - e.g., Kurt Kinetic trainer + Wahoo speed sensor - are allowed in zPower only races.”

The above intention is still valid today, as was confirmed in a recent thread:

“zPower” for hardware restricted events captures everything that isn’t a dedicated power meter (Quarq, SRM, Stages, Wattbike, etc.) and “power meter” captures the dedicated pieces of hardware. Some equipment like spin bikes say they come with a power meter and while they do measure power to some extent, they don’t do it in the same way or with the same accuracy as the dedicated power meters, so we don’t include them with “power meters.” zPower restrictions should also include the salad spinners and ski ergs of the world as well.“”

As far as I know, the following would be the expected behavior:

  • "Why can’t I join the event in Zwift even though I’m signed up?
    • While Hardware Requirement doesn’t prevent you from signing up for the event ahead of time, you will be prohibited from joining the event just before start if you don’t have the correct hardware paired. (…)
    • If, during the test period, you are attempting to join the event with the incorrect hardware paired, you will be unable to join the pen at the time of the event. That means zPower-racers cannot join the Smart Trainer/Power Meter required events, and smart trainer/power meter-racers cannot join the zPower required events."

Unfortunately this is not at all how the feature is currently working, as I will demonstrate below. Note that I picked an example that was easy for me to test, but, I assume, can be extrapolated to additional equipment.

The app I used was “HR2VP”, which can be downloaded by anyone. The goal of the App is to convert a measured heart rate to a virtual power output. This allows the user to exercise on whichever equipment, including rowing machines and cross trainers. A change of HR will result in a change of power output, and this will move your avatar accordingly. It does not require much imagination to understand that this will not be the most reliable equipment, even when trying to set up things as accurately as possible (which in this case I did not, to make it egregiously clear).

Step 1: Open the App on a mobile phone, follow the steps, then search for your “Power meter” in the pairing screen. For completeness, the controllable was left as my smart trainer, but I do not think this is a relevant detail for this bug.

Step 2: Sign up to a hardware enforced event:

Step 3: So far so good, let’s enter a world and try to join the race:


Voila! The “Join Event” button appears with no warning message whatsoever. But wait, maybe the event was not set up properly?

Step 4: Uncouple the HRM to try and trigger a warning notification. Take a special notice of the warning message asking about the HRM, and no mention that my power meter would be illegible. The 120W output at 1RPM is a very credible measurement, indeed.

Step 5: Show that it is possible to join the event (which I definitely should have been prevented to do).

I have also uncoupled my power meter, prompting the warning message as expected, and then paired the same HR2VP “power meter” successfully, but I forgot to screenshot that as well. As you can clearly see, nothing is withholding me from joining a power-enforced race with what I think is an even more inaccurate setup than the average Wheel-on. I obviously exited the race at this point out of respect for the other racers. I was able to reproduce this in another, independent event (different organiser).

Note that I am not trying to exploit this bug to mess up other peoples’ races - hence why I exited the race. Rather, hardware enforced races were intended to provide an environment for riders wanting to race against genuine and similar/comparable (cycling) equipment. I understand that there are additional ways to boost performances and that can never be prevented beforehand, but at least those require a deliberate action to cheat. The feature was intended to provide a place where a racer does not have to bother about (illegitimate ZADA verification level) performances due to faulty equipment, or Ski-ergs and salad spinners for that matter. Frankly, in this current bugged state, I cannot see much use for the feature and I hope it can be fixed.

Good Find! Curious to see how they close this loophole.

Appreciate all the detail, images, and steps to find it. Thank you for the write up. I’ll get this one checked in with the team and see what we can do to fix it.

We won’t have a concrete date when it will be fixed, though we’ll look at it as a team to understand the complexity and best solutions forward. Thanks again!

1 Like

Told ya so… (Ok, this is HRM+readily available app so slightly different but still.)

1 Like

Please check the option that Hardware Requirment is checking Controllable Connection…this is how we can be sure that only SMART Trainers are connected.
Power Source can be manipulated with a simple Mobile App and if you can fix this along the way great.

I am not sure if I understand how that would work. In the above example I had my Neo as controllable so I suppose that would pass your criteria? And if the power and controllable need to match then power pedals would be blocked also.

I appreciate it may be hard to fix, but I think a list of device identifiers hard coded as “power” or “zpower” could go a long way. It would not eliminate spoofing, but that IMO clearly enters the realm of intentional cheating/exploiting. I think (and want to believe) that the vast majority is simply unaware that their power source may be less accurate, or in the case of HR2VP apps is unaware that a power-enforced race event is aimed at higher equipment standards. Since the majority of events allow any power source it would not significantly impact the experience of those not on “power” equipment either.

At the moment you don’t need Smart Trainer and any Spinbike or App that is giving out Virtual Power can enter Hardware Requirment race without control of trainer resistance.

I know there’s a work around but we would at least avoid 400W monsters on Spinbikes or Zpower setups.

Is it reasonable to post this here?

Sure. Unless you can give me the address for the bug bounty programme and then I’ll move it to there.

7 Likes

In any case it seems less unreasonable than being able to enter hardware enforced races and generate 1600w while sleeping. In my arrogant opinion.

2 Likes

I just sweated my way up AduZ for the 25th time this morning when I could have just sat on the lounge instead … what would have been the fun in that!

tron bike in 2 days.

1 Like

There is nothing wrong with the use of the app shown above, it is actively supported by Zwift. The issues is that it is allowed in Hardware enforced races, which is a clear bug. So why has the post above been flagged as inappropriate?

Is this where we are now? Really?


1 post flagged as inappropriate.

2 Likes

I confirmed the flag. It was on the fence for me so I went for the safe option. Sorry James.

It seems it is quite an automatic way to deal with flags lately…

1 Like

the only time zwift ever fixes or acknowledges this kind of crap is when it gets posted on these forums

3 Likes

I agree. And the link got attention and it has been there long enough.

Now let’s assume that Zwift will find a way to limit the use of “Hacks” like this.

@xflintx Did reply above that Zwift is looking into this.

It should not have been flagged, but in a thread like this my guess is that flagging it won’t reduce the number of views at all. Possibly the opposite, especially coming from a respected person.

2 Likes

I appreciate all the good work you do on this forum and you have some tough decisions to make.

But I would say ‘ let’s assume that Zwift will find a way to limit the use of “Hacks” like this - now that somebody has been prepared to expose it publicly’

I’m sure most people believe nothing will be done unless it is exposed publicly.

2 Likes

They already know of people using man in the middle hacks to race with and do nothing, so don’t hold your breath

1 Like