{
  "schema": "phishdestroy.reading-edition.v2",
  "schema_url": "https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/article.schema.json",
  "object_type": "Dated article reading edition with PDF digest",
  "id": "trade-tracking",
  "language": "en",
  "title": "How skin casinos use the Steam session — PhishDestroy",
  "author": "Agent Leon",
  "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking",
  "source_file": "steam_dossier/trade-tracking.html",
  "source_html_sha256": "fc1c459577573c11aaf06d8b3dfee3e92048c7900dee2587209083e5dbb1092b",
  "exported_at": "2026-10-18T11:58:30.589Z",
  "edition_date": "2026-10-18",
  "scope": {
    "text": "Authored discussion and analytical tables from the current source HTML. Interactive controls and navigation are omitted; interactive datasets remain linked.",
    "omissions": [],
    "evidence_status": "The signature authenticates this publication, not the truth or authenticity of third-party evidence."
  },
  "pdf": {
    "filename": "trade-tracking.pdf",
    "url": "https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/en/trade-tracking.pdf",
    "sha256": "c68595a4fdec79a305d6811f1ac00eed135afc910a5fea384f3280e748479040",
    "bytes": 396277,
    "pages": 26
  },
  "integrity": {
    "signed_object": "trade-tracking.content.json",
    "signature_url": "https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/en/trade-tracking.content.json.asc",
    "checksum_url": "https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/en/trade-tracking.content.json.sha256",
    "format": "ASCII-armored detached OpenPGP",
    "signing_key_fingerprint": "129FC7F39C40C69D2EF3C329BFCF9E8DD295EE01",
    "public_key": "https://phishdestroy.io/.well-known/pgp-key.txt",
    "scope": "Exact UTF-8 JSON bytes, including content and the PDF SHA-256. No cryptographic PDF document signature is asserted."
  },
  "license": {
    "identifier": "CC0-1.0",
    "application": "Authored material only; third-party material retains its own rights.",
    "rights_statement_url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/license-rights.json",
    "rights_statement_sha256": "80d67354f8e5efd65b03696be950fb0f95c188d0089b1604281d0a4daff3f4cb"
  },
  "content": {
    "text": "Contents · Live article\n\nCSGOEMPIRE / CSGOROLL / CSGOFAST · REVIEWED 10 OCTOBER 2026\nInside the Steam session.\nINVESTIGATION BY AGENT LEON\n\nHow casino trade tracking turns the user’s logged-in account into part of the settlement system.\n\nA skin can move directly between two Steam accounts while the commercial transaction remains under the casino’s control. Empire’s instructions explain why it wants access to the user’s trade history: it uses the result to decide when the seller receives coins. Its extension shows how that access is obtained and renewed. Roll and Fast use different implementations, examined separately below.\n\nInspect the mechanism ↓Compare all three operators\nACQUIRED FROM GOOGLE’S UPDATE SERVICE\nTrade Token Sync 1.2.4\nsteamLoginSecurecookies · scripting · storage · tabs<all_urls>\n\nThe official Empire guide links to this extension. The package identity and signatures were checked.\n\nCODE EXAMINED / NO ACCOUNT CONNECTED\nWHY THIS MATTERS TO OWNERSHIP\n\nThe ability to send a skin does not give the user control over the exchange. Steam must allow the transfer, and the outside operator must recognise it and release the return. The code and policies below identify the decisions that remain with those intermediaries. Read the physical-ownership comparison ↗\n\nOriginal 11 October edition · complete text →Preserved original wording, alongside the current sections →\n01 / THE CLAIM AND THE IMPLEMENTATION\nEmpire receives an authentication credential from the Steam session\n\nEmpire offers two ways to enable tracking: copy a token from an authenticated Steam page, or install the extension linked by its guide. Both routes are presented as ways to verify completed trades and release the seller’s coins. [T01] [T02]\n\n“The token can't be used for anything else.”\nCSGOEmpire · Trade Tracking (Desktop Guide) [T01]\n\nThe downloaded extension makes the handoff explicit. Its background/steam.js reads the steamLoginSecure cookie, separates the Steam account ID from the access token, and returns that token. The upload code can then send it unchanged to a registered partner endpoint. This is authentication material from the account’s existing session, not a receipt generated for one completed trade. [CT02]\n\nThat distinction is essential when assessing the assurance above. The reviewed path contains no exchange for a new credential restricted to one trade or history method. What the exported token can actually authorise is determined by Steam’s receiving endpoints. The code establishes the export; a claim that the credential is technically incapable of any other use requires evidence of those endpoint restrictions. Describing its intended use does not demonstrate its enforced limits. [CT05]\n\nCODE PATH / TRADE TOKEN SYNC 1.2.4\nOne session. A continuing connection.\nIllustrated from code\nNot live account traffic\n\nRead the login cookie, inspect the token’s expiry and check the registered recipient. A token close to expiry takes a separate refresh branch; a later cookie change can start another sync.\n\nSTEAM BROWSER SESSION\nLogin cookie\n\nSteam ID + access token\n\nsteamLoginSecureRead the cookie finding\nEXTENSION WORKER\nExtract token. Check expiry.\n\nCookie permission + host access\n\nThe Steam credential is not narrowed.Inspect the extraction\nREGISTERED RECIPIENT\nReceive the token.\n\nRecipient, account and freshness checks\n\nPUT → configured endpointInspect the recipient gate\nCONDITIONAL / BELOW 1 HOUR\nRequest a Steam refresh.\n\nInactive tab · closed after 5 seconds\n\n/jwt/refreshInspect the refresh branch\nCONDITIONAL / NEXT PASS\nIf the cookie changes…\n\nSchedule another sync after 10 seconds.\n\nThe refresh pass itself sends no token.Inspect the next trigger\nPLATFORM SETTLEMENT\nTrade verification.\n\nThe service checks the trade for its own settlement process.\n\nItem delivery and coin release are separate.Follow the two records\n\nREFRESH IS CONDITIONALThe illustration follows a successful cookie update into a later sync. A later sync reads the changed cookie; recipient and freshness checks govern the upload. CT03 · CT05\n\nThe extension extracts a Steam-issued token and can ask Steam to refresh the session before sending a newer token. The partner-registration checks and timing conditions are explained in the next section. CT02–CT05 ↗\nWHY USE A BROWSER EXTENSION?\nThe browser permissions explain how the extension reaches that credential\nMANIFEST HOST REQUEST<all_urls>\nDESCRIBED TRADING TASKSteam + participating sites\n\nThe manifest requests access across all matching URLs, beyond the Steam and partner pages needed for the described transaction.\n\nScope requested by the package, subject to Chrome’s restricted pages and the user’s site-access settings.\n\ncookies\n\nReads the Steam login cookie through the extension API.\n\nscripting + tabs\n\nInjects a page bridge into eligible open tabs and opens an inactive renewal tab.\n\ncontent scripts\n\nA universal message bridge is declared for all matching URLs.\n\ntrade editor\n\nA Steam-page script adds specified items to the draft trade on either side.\n\nAn ordinary page script does not receive Chrome’s privileged cookies API. An extension with the required cookie and host permissions can retrieve cookies through that API, including cookie records marked HttpOnly. Installing this package gives code a route into the Steam session that an ordinary visit to the casino’s website does not provide. [T32] [T33]\n\nThe package also contains a script for Steam’s trade-offer page. It adds specified items to the draft and redraws the offer, so the browser component performs a write operation as well as reading session data. This particular path does not submit or confirm the offer. These browser capabilities and the operations Steam accepts with an exported token are separate parts of the access model. [CT06]\n\n02 / FOUR DIFFERENT CLOCKS\nRenewal makes the connection persist beyond a single token\n\nThe guide’s daily replacement instruction describes the manual route. The extension implements a renewal process driven by the token’s expiry and browser events. Four timings appear in the instructions and code, and they perform different jobs. [T01] [CT03] [CT04]\n\nGUIDE / MANUAL TOKEN24 h\n\nThe replacement cadence stated in Empire’s instructions.\n\nCODE / EXPIRY THRESHOLD< 1 h\n\nRemaining lifetime that triggers a session-refresh attempt.\n\nCODE / WORKER INTERVAL10 min\n\nThe interval registered by the worker for another sync.\n\nCODE / COOKIE CHANGE10 sec\n\nThe delay after a matching login-cookie change before syncing.\n\nThe refresh branch opens Steam’s /jwt/refresh route in an inactive tab, waits five seconds and removes the tab. A timestamp in session storage limits these refresh attempts to one per hour. A later cookie event drives the next sync. These are renewal instructions operating inside the user’s existing browser session. [CT03]\n\nWorker startup, page-triggered requests, a registered interval and matching cookie changes can all invoke synchronisation. Together they are designed to keep a partner supplied with a current token while the browser can obtain one. Expiry therefore limits the life of a particular credential without necessarily ending the commercial connection. [CT04]\n\nSTEAM JWT\nThe credential being exported.\n\nRead from the Steam cookie. Its expiry is decoded locally. Steam remains the authority that accepts or rejects it.\n\nPARTNER-REGISTRATION JWT\nThe extension’s recipient gate.\n\nA separate ES256-signed document identifies permitted domains and endpoint paths. It is checked against the extension’s embedded verification key, issuer and expiry.\n\nBefore upload, the code checks a registered site’s Steam ID and skips transfer if that site reports an equally new or newer token. The two JWTs in this process have different roles. The partner-registration signature authorises a recipient domain and endpoint; it does not change the Steam token being sent. Recipient approval and Steam permissions are two separate controls in the same transfer. [CT05]\n\nThe page bridge can register a signed partner and trigger synchronisation; the extension handler contains no additional confirmation dialog for that registration. Removing a stored registration stops future uploads through that route. The removal function contains no call to Steam to revoke a token already supplied. Disconnecting a destination and invalidating its copy of a credential are therefore different events.\n\nA separate startup issue: an empty partner list still reaches the cookie reader\n\nenumerateDomainConfigs() returns an object, but the worker tests its .length against zero. With an empty object, that early return is not taken. An offline fixture confirmed that startup still reads the synthetic Steam cookie. The actual upload routine enumerates zero destinations in this case; this finding concerns unnecessary access and possible refresh work, not an observed transmission. [CT07]\n\n03 / THE ITEM AND THE MONEY FOLLOW DIFFERENT RULES\nSteam delivery and the casino’s payout are separate events\n\nThe purpose of this monitoring becomes clear in Empire’s settlement rules. Its dedicated charging guide says a bid or purchase removes coins from the buyer’s spendable balance immediately. The seller’s payout follows a separate process, so delivery on Steam does not itself create an immediately usable balance for the seller. [T10]\n\nTWO RECORDS\nPURCHASE / TRANSFER\nPROTECTION / REVIEW\nSETTLEMENT\nSTEAM ITEM\nSeller → buyer\n\nThe skin moves directly between their Steam accounts.\n\nReversal window\n\nThe buyer has the item while Steam protection applies.\n\nTransfer verified\n\nThe platform checks completion and reversal status.\n\nEMPIRE LEDGER\nBuyer debited\n\nCoins leave the buyer’s spendable platform balance.\n\nSeller payout pending\n\nEmpire says payout can take up to eight days. Special holds and credit exceptions have separate rules.\n\nSeller credited\n\nEmpire releases coins according to its own settlement policy.\n\nThe trade-protection notice says the platform retains the buyer’s funds during the reversal period. Its skin policy also permits a hold of up to a month for suspected stolen or scammed items. The seller can therefore deliver the skin before receiving spendable coins. Early-credit exceptions also depend on platform rules. The two users supply the item and the purchase balance, but Empire determines when the corresponding ledger entries become usable: a centrally administered C2C transaction with direct Steam delivery. [T06] [T07]\n\nPRICING AUTHORITY\nSeller asking prices sit inside the platform’s pricing system\n\nEmpire derives a reference USD price from outside markets, chiefly BUFF, and converts it to Empire Coins. Sellers can edit their asking price. The platform controls the reference, conversion, auction routing and relisting conditions. That is centralised C2C market design. [T04] [T05] [T18]\n\nACCESS TO EARLY CREDIT\nPlaying is tied to a higher early-credit limit\n\nThe instant-credit scheme combines a tier allowance with half of the daily reward pool. Published tier allowances run from zero to 20,000 coins. Empire says increasing the limit requires progressing the account and playing; support cannot raise it manually. Reversed credited trades can produce deductions and a negative balance. [T09]\n\nFailed-trade fees escalate.\nFAILURES / SHARE OF ITEM OR BID VALUE\n1\n1%\n2\n2%\n3\n4%\n4\n8%\n5\n16%\n6\n32%\n7+\n50%\nPublished cap: 50%. Cooldowns rise to 50 hours; penalties reset after 48 hours without a failed trade. A minimum charge and auction price-lock also apply. [T08]\nA Steam reversal can trigger a separate financial penalty\n\nThe skin policy allows permanent marketplace restrictions. If the buyer reverses, the seller can recover the item and keep up to the full coin payment. A support-approved exception usually uses a 30/70 split, adjustable by the operator. The published policy does not state which side keeps which share: the split is the operator’s own remedy arithmetic, adjustable by the operator — publish the formula and every applied instance. [T07]\n\nThe operator also decides disputed outcomes\n\nSupport may request a screen recording, decide a dispute and apply exceptional treatment. The platform writes the rules, controls the ledger and decides how a dispute is resolved. Its own support process also decides whether an exceptional adjustment is warranted. [T07]\n\nOrdinary fees and failure penalties follow different rules\n\nThe published zero-fee statement concerns routine skin deposits and withdrawals. Failed-trade penalties can still reach 50% of the item or bid value, and early-credit limits depend partly on play. A reader evaluating the cost and control of the service needs all three rules together. [T15] [T16]\n\nThe instructions conflict on protection, debit timing and cancellation\nSteam protection and the payout delay are blurred.\n\nThe mobile guide describes seven-day protection; the desktop guide calls it eight days. The protection notice describes seven days on Steam and up to eight days to receive coins. Users need the Steam deadline and the platform’s additional delay stated separately. [T01] [T02] [T06]\n\nTwo instructions give different debit events.\n\nThe dedicated charging article says coins are removed immediately on a bid or withdrawal. The general withdrawal guide describes deduction after receiving the item. The ledger event should be consistent across both instructions. [T10] [T11]\n\nOld and new cancellation rules remain side by side.\n\nAn April 2024 article says buyers cannot cancel an active withdrawal. A July 2026 article permits some normal withdrawals to be cancelled after thirty minutes, with tracking enabled and before the seller sends. Both remain in the collection. The collection leaves the reader to reconcile them. [T12] [T13]\n\nPenalty review remains inside the same platform.\n\nThe punishment guide permits users to ask support to review an unfair penalty. The skin policy allows corrections when the platform recognises an error. Both remedies are administered by the operator controlling the balance. [T08] [T07]\n\nThe business no longer needs to hold every skin in its own bot inventory. Empire describes direct user delivery alongside seller listing automation. Its privacy feature can hide item identifiers from prospective buyers. The participant’s inventory now supplies the delivery route. A count of banned accounts cannot show who lost their skins or whether the operator’s business was stopped without identifying those account categories. [T17] [T14] See the account-count comparison ↗\n04 / CSGOROLL’S TWO EXTENSION IDENTITIES\nRoll’s older automatic extension and its current token popup are different packages\n\nThe June 2024 announcement describes automatic token collection, expiry handling and background transmission. Its link targets an older extension ID. Roll’s current short URL points to a different package that still extracts a Steam token for the user to hand over. [T27] [T28]\n\n2024 ANNOUNCEMENT / OLDER ID\nCSGORoll extension\ncgkgfnlnpcifjnbfdbmcphcgnkeinjpdUPDATE RESPONSE: HTTP 204\n\nGoogle’s update service returned no package in this check. The store URL resolved to an empty-title shell without an extension listing. [T29] [T46]\n\nCURRENT REDIRECT / DIFFERENT ID\nSteam WebAPI Token Extension\nbdgacfnoihldeemdcbggkgmjgdfcliahUPDATE RESPONSE: HTTP 200 · v1.2\n\nThe current package was returned again with the same hash as the earlier audit. It extracts a token in a popup for copying. Its registered manifest has no background worker or daily scheduler; current help describes pasting the token into Roll. [T30] [T31] [T42]\n\nThe current help still asks the user to supply a Steam token to Roll. In version 1.2 the final handoff is manual, whereas the older announcement described background collection and upload. The distinction changes the technical mechanism, not the stated purpose: Roll obtains account information to recognise trades and administer its own balance. [T31] [T42]\n\n05 / CSGOFAST: THE CURRENT CONNECTION AND THE IDENTITY CLAIM\nFast’s own trading interface links SIH and checks its permissions\n\nThe connection is in CSGOFast’s own shipped application. Its trading interface links to SIH, checks the extension’s connection and permission state, and asks the platform backend whether the user can trade. [T38] [T39]\n\nA named installation targetThe installation component links to Steam Inventory Helper’s Chrome extension ID cmeakgjggjdlcpncigglobpjbkabhmjl. The modal loader imports this component through a separately fetched module. [CF01]\nA connection-and-permission conditionThe interface reads connections.SIH and checks both online and permission. The check button and warning state depend on those values. That is a concrete dependency in the shipped trading interface. [CF02]\nA platform decision endpointThe client requests its own backend’s /api/market/steam/check-user route and consumes the resulting permission state. Fast’s own frontend establishes the integration. The linked SIH audit traces the extension’s credential retrieval and server-command mechanisms. [CF03] [T42]\n“The Site does not present itself as a gambling platform.”\nCSGOFast · Responsible Play Policy §8.1 [T35]\nITS OWN DESCRIPTION\nThe non-monetary label sits beside paid funding routes\n\nThe same policy denies real-world value to items and Credits. Its FAQ describes funding by skins, partner gift codes, cryptocurrency and card-mediated crypto purchases, followed by a balance credit. The user incurs a real acquisition cost even where the resulting unit has restricted redemption rights. The operator’s description of its credit does not establish that the surrounding business is free of monetary value or payment relationships. [T35] [T37]\n\nAN EXTERNAL LEGAL RECORD\nThe same domain appears in a final Dutch gambling-enforcement record\n\nIn April 2025, the Dutch Ksa ordered Gamusoft LP to stop unlawful gambling offered through csgofast.com. Its published record says the order became final and violations continued. Fast’s current non-gambling label cannot rewrite that enforcement record. [T41]\n\nTHE CONSEQUENCE FOR THE USER\n\nFast asks users to explain their identity and finances while its own account of the service remains inconsistent. The non-gambling presentation, funding instructions and AML demands must be read together. They describe an operator that controls access to the user’s balance and requests evidence about the real assets used to fund it. [T36]\n\nFast’s AML and privacy pages display a 2024 revision date while naming Lumigrid OÜ, registered in September 2026. The AML text pairs that Estonian company with UK law. It even treats unusual attention to its AML policy as a suspicion indicator. The user is expected to explain their finances to a service whose own disclosures contain these unresolved defects. Read the documentary findings ↗\n\nNEW CASE / VALVE’S 2016 ENFORCEMENT CLAIM\nCSGOFast, SIH and the commercial control that survived\n\nFive interface exhibits, 33 code locations, authenticator custody and the record before the commission.\n\n↗\nRead the original 11 October wording\n\nPreserved verbatim from the supplied 11 October 2026 edition. “Today” and “currently” refer to that edition; its original estimates and formulations remain available alongside the dated text above.\n\nFour interface exhibits, 33 code locations, authenticator custody and the record before the commission.\n\nOpen this passage in the complete original edition →\n06 / THREE OPERATORS, SPECIFIC IMPLEMENTATIONS\nWhat the three implementations establish\n\nAPI means an interface. A publisher key, a user API key and a session JWT are different credentials. None of these browser workflows requires the user to be a game developer. Original three-column credential comparison ↗\n\n01 / ACCOUNT ACCESS\nCSGOEmpire\nIDENTIFIED PACKAGE\nTrade Token Sync 1.2.4, linked by Empire’s guide. [T24]\nACQUISITION\nReads the Steam login cookie and extracts its JWT. Manual help uses Steam’s token page.\nRENEWAL\nExpiry threshold, cookie event, worker startup and ten-minute interval; inactive Steam refresh tab.\nCONTROL ESTABLISHED\nA session credential leaves the browser through a developer-approved recipient route. The platform controls payout, holds and sanctions.\n02 / ACCOUNT ACCESS\nCSGORoll\nIDENTIFIED PACKAGE\nCurrent token-popup extension 1.2; older automatic extension has a different ID. [T27] [T28]\nACQUISITION\nCurrent popup obtains the WebAPI token from authenticated Steam content, then offers a copy action.\nRENEWAL\nAutomatic renewal is described in the older announcement. It is absent from the current package’s registered entry path.\nCONTROL ESTABLISHED\nThe current workflow still hands a Steam token to Roll. Manual copying changes the handoff, not who receives the credential.\n03 / ACCOUNT ACCESS\nCSGOFast / SIH integration\nIDENTIFIED CONNECTION\nCurrent site code links the SIH ID and checks its connection and permission. [CF01]\nACQUISITION\nSIH’s reviewed worker can supply a Steam WebAPI token in response to a server request; Fast’s frontend establishes the connection flow.\nRENEWAL\nThe earlier SIH audit found retry-on-403 and cached token retrieval, not a fixed daily scheduler.\nCONTROL ESTABLISHED\nThe trading interface checks SIH connection and permission; Fast’s backend supplies the trading-permission state.\nThe technical evidence explains the dependence that the collectibles analogy omits\n\nThese implementations differ in extraction, renewal and transfer. Empire’s code exports a Steam session token through an approved-partner mechanism; Roll’s current package prepares a token for manual submission; Fast’s own interface links an SIH permission flow. They show concrete ways in which a user’s Steam account becomes part of an outside service’s verification process.\n\nThe settlement rules explain why that access matters. Steam determines whether the item can move, while the casino determines how the recognised transfer changes its own balance. Physical ownership is a misleading model for this dependence: neither possession in a Steam inventory nor delivery to another user removes the need for those continuing permissions. Valve’s response and the ownership comparison ↗\n\nTrade Token Sync’s linked privacy notice does not explain this credential lifecycle\n\nThe Chrome listing declares handling authentication information and links to a guest Pastebin privacy notice dated 5 August 2025. That notice discusses broad website data, profiling, partners and session replay, and still refers to EU–US Privacy Shield. It does not set out a token-specific retention period, the signed partner registry, the background renewal mechanism or deletion of uploaded credentials. The missing explanation concerns this extension’s actual data flow. [T24] [T26] Why the transfer-safeguard reference matters ↗\n\nWhat the operators still owe their users\nPublish the Steam methods and account data accessible with the exported token, and demonstrate any claimed history-only restriction.\nExplain why all-URL host access and a universal page bridge are necessary for the stated trading task.\nIdentify the partner-registration signer, current recipients, approval process and revocation mechanism.\nDisclose token retention, employee access, server request logs and deletion after a site is disconnected.\nProvide a consistent timeline for buyer debit, Steam protection, platform holds, early credit and final payout.\nFor CSGOFast, identify the SIH permissions used and reconcile the non-gambling policy with the payment route, AML demands and named enforcement record.\n07 / REPRODUCIBLE CODE RECORD\nPackage. File. Location.\n\nThe findings below pin original filenames, hashes and search anchors. The downloadable record includes acquisition responses and the review of all 22 articles in Empire’s linked collection.\n\nDownload evidence record ↗Manifest ↗\nCT01Browser authority extends beyond Steam history\n\nThe manifest requests cookies, scripting, storage and tabs, with all-URL host access. It registers a universal content script and a Steam trade-offer script. The worker also injects the universal bridge into eligible already-open HTTP(S) tabs. The universal bridge extends the extension’s reach beyond a single casino tab.\n\nempire / manifest.json\n\nOriginal line 12 · UTF-8 byte 294\n\nFind: \"permissions\"\n\nSHA-256 367cebed484e3007511fefed990fffbffa6509f6b2ca1354696a75fb3953931f\n\nempire / background/service-worker.js\n\nOriginal line 39 · UTF-8 byte 1426\n\nFind: injectContentScriptIntoExistingTabs\n\nSHA-256 ad5caa9c9974f56bc28de449ad7a8b8351810c2c7a7c22b491f243acadb6316f\n\nCT02The exported credential is extracted from the Steam login cookie\n\nThe cookie reader requests steamLoginSecure using chrome.cookies.get, URL-decodes its value and separates the Steam ID and access token. It decodes expiry and returns the token without a narrowing exchange. With a synthetic two-hour token, the original function returned the identical token.\n\nempire / background/steam.js\n\nOriginal line 33 · UTF-8 byte 910\n\nFind: async function getSteamLoginSecureCookie\n\nSHA-256 6136673df2e6bdc4b3fc8a7a2f8f67fa4b84810da704e4a39577454c0e248490\n\nCT03Session renewal uses an inactive Steam tab\n\nIf expiry is less than one hour away, getSteamAccessToken calls refreshSteamSession. The function throttles attempts to once an hour through session storage, opens an inactive Steam /jwt/refresh tab, waits five seconds and removes it. The read returns null on this pass; the intended next sync follows a cookie update. This behavior was exercised with invented cookies and mocked browser APIs.\n\nempire / background/steam.js\n\nOriginal line 19 · UTF-8 byte 510\n\nFind: jwtExpiresAt.getTime()\n\nSHA-256 6136673df2e6bdc4b3fc8a7a2f8f67fa4b84810da704e4a39577454c0e248490\n\nempire / background/steam.js\n\nOriginal line 45 · UTF-8 byte 1334\n\nFind: async function refreshSteamSession\n\nSHA-256 6136673df2e6bdc4b3fc8a7a2f8f67fa4b84810da704e4a39577454c0e248490\n\nCT04Daily expiry, periodic checks and cookie events are distinct\n\nThe worker calls doSteamSync at startup and registers a ten-minute interval. A matching Steam login-cookie change schedules another sync after ten seconds. An authorised page may also request a sync; that page-triggered path is throttled to once a minute. Chrome worker suspension was not simulated.\n\nempire / background/service-worker.js\n\nOriginal line 36 · UTF-8 byte 1242\n\nFind: setInterval(doSteamSync\n\nSHA-256 ad5caa9c9974f56bc28de449ad7a8b8351810c2c7a7c22b491f243acadb6316f\n\nempire / background/service-worker.js\n\nOriginal line 42 · UTF-8 byte 1526\n\nFind: chrome.cookies.onChanged\n\nSHA-256 ad5caa9c9974f56bc28de449ad7a8b8351810c2c7a7c22b491f243acadb6316f\n\nempire / background/injected-api.js\n\nOriginal line 120 · UTF-8 byte 3247\n\nFind: async function triggerSync\n\nSHA-256 0095ac14d4175b783f2160980ca881e3c5627a8f36004b59cadf6feacf5eeab4\n\nCT05Signed partner configuration governs where the credential goes\n\nA distinct ES256 registration JWT is checked using an embedded key, issuer, time claims, domain patterns and endpoint paths. The extension stores valid configurations in sync storage. Upload checks a reported Steam ID and token expiry, then PUTs the access token to the configured endpoint. setDomainConfig has no extension-owned confirmation dialog. clearDomainConfig removes the registration without calling a Steam revocation route. These checks control recipients; they do not narrow the Steam credential.\n\nempire / background/jwt-verifier.js\n\nOriginal line 8 · UTF-8 byte 313\n\nFind: export async function verifyDomainJwt\n\nSHA-256 4b34276f5510aa4c72939b6eafe8e4021d943ff199e425048903effa8930392c\n\nempire / background/partner-sites.js\n\nOriginal line 36 · UTF-8 byte 999\n\nFind: export async function uploadNewAccessToken\n\nSHA-256 96581ffe9c2dcad46d4c1090bb5cbb5790891df0d0bbf162b82bfb402cadf53d\n\nempire / background/injected-api.js\n\nOriginal line 67 · UTF-8 byte 1607\n\nFind: async function setDomainConfig\n\nSHA-256 0095ac14d4175b783f2160980ca881e3c5627a8f36004b59cadf6feacf5eeab4\n\nempire / background/injected-api.js\n\nOriginal line 113 · UTF-8 byte 3037\n\nFind: async function clearDomainConfig\n\nSHA-256 0095ac14d4175b783f2160980ca881e3c5627a8f36004b59cadf6feacf5eeab4\n\nCT06The Steam-page script modifies the draft offer\n\nThe injected script reads item identifiers from URL parameters, adds missing entries to either side of g_rgCurrentTradeStatus and redraws the draft. No submit or confirmation call appears in this file. This is a separate interface-writing capability from trade-history access.\n\nempire / content-scripts/tradeoffer.js\n\nOriginal line 12 · UTF-8 byte 246\n\nFind: const theirItems\n\nSHA-256 32481abc873f43965b41cebfff93ebdc9d0dee82ac6027fbd8f5d544e23de1af\n\nempire / content-scripts/tradeoffer.js\n\nOriginal line 62 · UTF-8 byte 1368\n\nFind: window.RedrawCurrentTradeStatus\n\nSHA-256 32481abc873f43965b41cebfff93ebdc9d0dee82ac6027fbd8f5d544e23de1af\n\nCT07The empty-registration early return uses the wrong data shape\n\nenumerateDomainConfigs returns an object. doSteamSync checks its length as though it were an array. In an offline empty-object fixture, the worker still invoked the cookie reader. The real upload implementation enumerates zero domains in that situation. The recorded defect is the worker’s object-versus-array test and the resulting cookie-read invocation.\n\nempire / background/service-worker.js\n\nOriginal line 14 · UTF-8 byte 540\n\nFind: domainConfigs.length === 0\n\nSHA-256 ad5caa9c9974f56bc28de449ad7a8b8351810c2c7a7c22b491f243acadb6316f\n\nempire / background/partner-sites.js\n\nOriginal line 96 · UTF-8 byte 3080\n\nFind: const output = {}\n\nSHA-256 96581ffe9c2dcad46d4c1090bb5cbb5790891df0d0bbf162b82bfb402cadf53d\n\nCF01The current Fast frontend contains an SIH installation path\n\nThe SIH component points to Chrome extension ID cmeakgjggjdlcpncigglobpjbkabhmjl. The main application references the public component chunks; its modal registry imports chunk-WXK6SRSN.js, which imports this component. This places the SIH connection flow in CSGOFast’s own frontend. The dedicated case follows that integration into SIH’s registered account-operation handlers.\n\nfast / chunk-4J5LYWSH.js\n\nOriginal line 3 · UTF-8 byte 1338\n\nFind: //chrome.google.com/webstore/detail/steam-inventory-helper\n\nSHA-256 4ed0af788a6ef319c3f8bfb55f06252f16ff705d50bb10da2eae05da54c057bf\n\nfast / chunk-CJLFSPQI.js\n\nOriginal line 10 · UTF-8 byte 74042\n\nFind: SIH_INSTALL\n\nSHA-256 6fa061bbe3343c763ab641c1a71126558a40c1add657788b33d6f10164eb0f56\n\nCF02Fast checks SIH online state and permission\n\nThe component reads p2pPermissions.connections.SIH. Its disabled and warning state depends on whether the connection exists, is online and has permission. The dialog closes when both online and permission become true. The general P2P component also reads this connection state.\n\nfast / chunk-4J5LYWSH.js\n\nOriginal line 3 · UTF-8 byte 1743\n\nFind: checkBtnDisabled$\n\nSHA-256 4ed0af788a6ef319c3f8bfb55f06252f16ff705d50bb10da2eae05da54c057bf\n\nfast / chunk-4OFQKOVU.js\n\nOriginal line 6 · UTF-8 byte 13931\n\nFind: connections?.SIH\n\nSHA-256 6ab7ee0bbecb2fc844689f73131343e588bd3cf4850156ee99d96eb6469a57da\n\nCF03The Fast client asks its backend for Steam-trading permission state\n\nThe client service has getP2pPermissions requesting /api/market/steam/check-user with credentials. Another component consumes canSteamAPI and a steamApiKey field. These names establish the frontend contract, not the actual format of a user’s secret or the backend’s Steam access. No authenticated endpoint was called in this review.\n\nfast / chunk-2FZZMIT7.js\n\nOriginal line 3 · UTF-8 byte 182042\n\nFind: getP2pPermissions=t=>\n\nSHA-256 0eee2c9e863b98d6aed571d198a78c76cf4d4100b7219208b6530b1cbf2a3309\n\nfast / chunk-ONY24YIU.js\n\nOriginal line 3 · UTF-8 byte 8322\n\nFind: apiKey$=\n\nSHA-256 f6a72f25785c3772f47f7e2557251c89e54683358d96a4b89ac7ee24566d9606\n\nAll 22 Empire trading articles reviewed\nT01 · Trade Tracking — Desktop ↗\n\nManual token handoff, daily replacement, automatic checks and extension referral.\n\nT02 · Trade Tracking — Mobile ↗\n\nManual Steam-token page and seven-day protection wording.\n\nT03 · How the P2P system works ↗\n\nUser-to-user delivery, seller prices, deadlines, pending payouts and disputes.\n\nT04 · How prices are calculated ↗\n\nExternal market inputs, USD reference and conversion to Empire Coins.\n\nT05 · Editing a listing price ↗\n\nThe seller can change the asking price and percentage.\n\nT06 · Trade protection update ↗\n\nSeven-day Steam protection, up-to-eight-day coin payout and held funds.\n\nT07 · Skin Trading Policy ↗\n\nReversals, coin allocation, exceptional holds and support discretion.\n\nT08 · Trade punishments ↗\n\nEscalating fees, cooldowns, price-locks and reversal restrictions.\n\nT09 · Instant Credit Limit ↗\n\nTier allowances, reward-pool component, play-based progression and recovery.\n\nT10 · When an item is charged ↗\n\nImmediate removal of spendable coins on a bid or withdrawal.\n\nT11 · Withdrawing Counter-Strike items ↗\n\nWithdrawal workflow and its different debit wording; seller-listing bots.\n\nT12 · Cancelling a withdrawal ↗\n\nJuly 2026 conditional cancellation with tracking enabled.\n\nT13 · Cancelling an active trade ↗\n\nApril 2024 no-cancellation wording still linked from the collection.\n\nT14 · Item privacy toggle ↗\n\nHiding item identifiers and simplifying seller ratings.\n\nT15 · Trading fees ↗\n\nZero routine skin-deposit and withdrawal fee statement.\n\nT16 · Wagering to withdraw skins ↗\n\nNo wagering requirement stated for skin withdrawals.\n\nT17 · Withdrawal duration ↗\n\nAuction and regular deadlines; no site-owned bots and seller automation.\n\nT18 · Auction listings and limits ↗\n\nRouting thresholds and relisting-price rules.\n\nT19 · Thirty-minute auction update ↗\n\nDated change to buyer and seller auction deadlines.\n\nT20 · Depositing Counter-Strike items ↗\n\nListing inventory and completing the transfer when another user withdraws.\n\nT21 · Telegram and Discord notifications ↗\n\nLinked notification accounts, event categories and unlinking.\n\nT22 · Updating a trade URL ↗\n\nTrade URL settings; distinct from a session credential.\n\nMethod and technical boundaries of this review\n\nWe reviewed public documents and downloadable client code, verified the Empire CRX signatures and extension-ID key match, and ran six isolated fixture checks. No extension was installed, no account connected and no live token obtained or replayed. Fixture results ↗\n\nThe code establishes extraction, renewal instructions, transmission paths and client-side integration. Server retention, actual production commands and Steam’s accepted operation set were not measured. Browser permissions and Steam-token permissions are separate; an unchanged exported token does not, by itself, establish every operation Steam will accept.\n\nThe ten-minute interval is registered in code. Chrome can terminate an idle service worker, so it is not a measured uptime guarantee. Startup, page requests and cookie events provide further sync triggers. [T34] The trade-offer script edits the draft but does not submit or confirm it.\n\nThe older Roll package returned HTTP 204, and its store link returned an empty listing shell. Neither response supplies Google’s reason. The current Roll popup package, the older announced automatic workflow and Empire’s renewal code are identified separately throughout the record.\n\nThe Dutch order concerns Gamusoft LP and csgofast.com in 2025. Its named operator, date and jurisdiction remain attached to the finding; the separate identity investigation examines the companies named in Fast’s current documents.\n\n08 / SOURCE REGISTER\nRead the underlying records.\n\nOperator instructions, published policies, Chrome documentation, official package delivery and identified frontend files. Retrieval timestamps and SHA-256 values are in the evidence download.\n\nOpen the full source register\nT01\nCSGOEmpire — Trade Tracking — Desktop ↗\n\nManual token handoff, daily replacement, automatic checks and extension referral.\n\nT02\nCSGOEmpire — Trade Tracking — Mobile ↗\n\nManual Steam-token page and seven-day protection wording.\n\nT03\nCSGOEmpire — How the P2P system works ↗\n\nUser-to-user delivery, seller prices, deadlines, pending payouts and disputes.\n\nT04\nCSGOEmpire — How prices are calculated ↗\n\nExternal market inputs, USD reference and conversion to Empire Coins.\n\nT05\nCSGOEmpire — Editing a listing price ↗\n\nThe seller can change the asking price and percentage.\n\nT06\nCSGOEmpire — Trade protection update ↗\n\nSeven-day Steam protection, up-to-eight-day coin payout and held funds.\n\nT07\nCSGOEmpire — Skin Trading Policy ↗\n\nReversals, coin allocation, exceptional holds and support discretion.\n\nT08\nCSGOEmpire — Trade punishments ↗\n\nEscalating fees, cooldowns, price-locks and reversal restrictions.\n\nT09\nCSGOEmpire — Instant Credit Limit ↗\n\nTier allowances, reward-pool component, play-based progression and recovery.\n\nT10\nCSGOEmpire — When an item is charged ↗\n\nImmediate removal of spendable coins on a bid or withdrawal.\n\nT11\nCSGOEmpire — Withdrawing Counter-Strike items ↗\n\nWithdrawal workflow and its different debit wording; seller-listing bots.\n\nT12\nCSGOEmpire — Cancelling a withdrawal ↗\n\nJuly 2026 conditional cancellation with tracking enabled.\n\nT13\nCSGOEmpire — Cancelling an active trade ↗\n\nApril 2024 no-cancellation wording still linked from the collection.\n\nT14\nCSGOEmpire — Item privacy toggle ↗\n\nHiding item identifiers and simplifying seller ratings.\n\nT15\nCSGOEmpire — Trading fees ↗\n\nZero routine skin-deposit and withdrawal fee statement.\n\nT16\nCSGOEmpire — Wagering to withdraw skins ↗\n\nNo wagering requirement stated for skin withdrawals.\n\nT17\nCSGOEmpire — Withdrawal duration ↗\n\nAuction and regular deadlines; no site-owned bots and seller automation.\n\nT18\nCSGOEmpire — Auction listings and limits ↗\n\nRouting thresholds and relisting-price rules.\n\nT19\nCSGOEmpire — Thirty-minute auction update ↗\n\nDated change to buyer and seller auction deadlines.\n\nT20\nCSGOEmpire — Depositing Counter-Strike items ↗\n\nListing inventory and completing the transfer when another user withdraws.\n\nT21\nCSGOEmpire — Telegram and Discord notifications ↗\n\nLinked notification accounts, event categories and unlinking.\n\nT22\nCSGOEmpire — Updating a trade URL ↗\n\nTrade URL settings; distinct from a session credential.\n\nT23\nCSGOEmpire — Counter-Strike deposits and withdrawals ↗\n\nAll 22 linked articles acquired and read.\n\nT24\nTrade Token Sync — Chrome Web Store ↗\n\nDirect response on 10 October: version 1.2.4, updated 28 September 2026; a search-engine rendering still showed 1.2.3.\n\nT25\nTrade Token Sync — Google update-service package ↗\n\nVersion 1.2.4; CRX hash and signature checks pinned below.\n\nT26\nPrivacy notice linked by Trade Token Sync ↗\n\nGuest Pastebin notice dated 5 August 2025; credential-specific disclosure examined.\n\nT27\nCSGORoll — WebAPI Trading Extension ↗\n\n25 June 2024: automatic collection, renewal and background transmission; older extension ID.\n\nT28\nCSGORoll — current extension redirect ↗\n\nResolved to Steam WebAPI Token Extension, a different ID.\n\nT29\nOlder CSGORoll extension — Google update response ↗\n\nHTTP 204 and zero bytes in this acquisition; no reason supplied.\n\nT30\nCurrent CSGORoll extension — Google package ↗\n\nHTTP 200; version 1.2; unchanged package hash from the earlier audit.\n\nT31\nCSGORoll — Steam WebAPI Token help ↗\n\nCurrent help instructs copying and pasting a token.\n\nT32\nChrome — Declare permissions ↗\n\nHost permissions, browser API capabilities and optional access.\n\nT33\nChrome — Cookies API ↗\n\nCookie and host permission requirements; cookie fields including HttpOnly.\n\nT34\nChrome — Extension service worker lifecycle ↗\n\nIdle termination and event-driven worker revival; a timer is not guaranteed uptime.\n\nT35\nCSGOFast — Responsible Play Policy ↗\n\nNo-gambling representation and no-real-world-value wording.\n\nT36\nCSGOFast — AML Policy ↗\n\nUser verification, document demands and asserted authority.\n\nT37\nCSGOFast — FAQ ↗\n\nSkin deposits, partner vouchers, cryptocurrency and card-mediated crypto funding.\n\nT38\nCSGOFast — P2P frontend component ↗\n\nReads SIH connection state in the trading interface.\n\nT39\nCSGOFast — SIH installation and permission component ↗\n\nOfficial SIH extension link and online/permission checks.\n\nT40\nCSGOFast — client service bundle ↗\n\nRequests the platform’s /api/market/steam/check-user endpoint.\n\nT41\nDutch Ksa — Gamusoft LP / csgofast.com ↗\n\nApril 2025 unlawful-gambling order; final status and continued violations recorded.\n\nT42\nPhishDestroy — earlier Roll and SIH code audit ↗\n\nPrior acquired packages, code findings and hashes; this is our audit record.\n\nT43\nCSGOFast — public application entry bundle ↗\n\nDirectly references the reviewed frontend chunks.\n\nT44\nCSGOFast — SIH modal import module ↗\n\nConnects the public modal loader to the SIH component.\n\nT45\nChrome — Content scripts ↗\n\nPage access, script injection and messaging with extension components.\n\nT46\nOlder CSGORoll extension — store URL ↗\n\nDirect request resolved to an empty-title shell without a listing.",
    "headings": [
      {
        "level": 1,
        "text": "Inside the Steam session.",
        "anchor": "pd-trade-tracking--heading-1",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#overview"
      },
      {
        "level": 2,
        "text": "Trade Token Sync 1.2.4",
        "anchor": "pd-trade-tracking--heading-2",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#overview"
      },
      {
        "level": 2,
        "text": "Empire receives an authentication credential from the Steam session",
        "anchor": "pd-trade-tracking--heading-3",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#session"
      },
      {
        "level": 3,
        "text": "One session. A continuing connection.",
        "anchor": "pd-trade-tracking--flow-title",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#flow-title"
      },
      {
        "level": 4,
        "text": "Login cookie",
        "anchor": "pd-trade-tracking--heading-5",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#credential-flow"
      },
      {
        "level": 4,
        "text": "Extract token. Check expiry.",
        "anchor": "pd-trade-tracking--heading-6",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#credential-flow"
      },
      {
        "level": 4,
        "text": "Receive the token.",
        "anchor": "pd-trade-tracking--heading-7",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#credential-flow"
      },
      {
        "level": 4,
        "text": "Request a Steam refresh.",
        "anchor": "pd-trade-tracking--heading-8",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#credential-flow"
      },
      {
        "level": 4,
        "text": "If the cookie changes…",
        "anchor": "pd-trade-tracking--heading-9",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#credential-flow"
      },
      {
        "level": 4,
        "text": "Trade verification.",
        "anchor": "pd-trade-tracking--heading-10",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#credential-flow"
      },
      {
        "level": 2,
        "text": "The browser permissions explain how the extension reaches that credential",
        "anchor": "pd-trade-tracking--heading-11",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#session"
      },
      {
        "level": 3,
        "text": "cookies",
        "anchor": "pd-trade-tracking--heading-12",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#session"
      },
      {
        "level": 3,
        "text": "scripting + tabs",
        "anchor": "pd-trade-tracking--heading-13",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#session"
      },
      {
        "level": 3,
        "text": "content scripts",
        "anchor": "pd-trade-tracking--heading-14",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#session"
      },
      {
        "level": 3,
        "text": "trade editor",
        "anchor": "pd-trade-tracking--heading-15",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#session"
      },
      {
        "level": 2,
        "text": "Renewal makes the connection persist beyond a single token",
        "anchor": "pd-trade-tracking--heading-16",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#clocks"
      },
      {
        "level": 3,
        "text": "The credential being exported.",
        "anchor": "pd-trade-tracking--heading-17",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#clocks"
      },
      {
        "level": 3,
        "text": "The extension’s recipient gate.",
        "anchor": "pd-trade-tracking--heading-18",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#clocks"
      },
      {
        "level": 2,
        "text": "Steam delivery and the casino’s payout are separate events",
        "anchor": "pd-trade-tracking--heading-19",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#settlement"
      },
      {
        "level": 3,
        "text": "Seller asking prices sit inside the platform’s pricing system",
        "anchor": "pd-trade-tracking--heading-20",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#settlement"
      },
      {
        "level": 3,
        "text": "Playing is tied to a higher early-credit limit",
        "anchor": "pd-trade-tracking--heading-21",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#settlement"
      },
      {
        "level": 3,
        "text": "Failed-trade fees escalate.",
        "anchor": "pd-trade-tracking--heading-22",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#settlement"
      },
      {
        "level": 3,
        "text": "A Steam reversal can trigger a separate financial penalty",
        "anchor": "pd-trade-tracking--heading-23",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#settlement"
      },
      {
        "level": 3,
        "text": "The operator also decides disputed outcomes",
        "anchor": "pd-trade-tracking--heading-24",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#settlement"
      },
      {
        "level": 3,
        "text": "Ordinary fees and failure penalties follow different rules",
        "anchor": "pd-trade-tracking--heading-25",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#settlement"
      },
      {
        "level": 3,
        "text": "Steam protection and the payout delay are blurred.",
        "anchor": "pd-trade-tracking--heading-26",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#settlement"
      },
      {
        "level": 3,
        "text": "Two instructions give different debit events.",
        "anchor": "pd-trade-tracking--heading-27",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#settlement"
      },
      {
        "level": 3,
        "text": "Old and new cancellation rules remain side by side.",
        "anchor": "pd-trade-tracking--heading-28",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#settlement"
      },
      {
        "level": 3,
        "text": "Penalty review remains inside the same platform.",
        "anchor": "pd-trade-tracking--heading-29",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#settlement"
      },
      {
        "level": 2,
        "text": "Roll’s older automatic extension and its current token popup are different packages",
        "anchor": "pd-trade-tracking--heading-30",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#roll"
      },
      {
        "level": 3,
        "text": "CSGORoll extension",
        "anchor": "pd-trade-tracking--heading-31",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#roll"
      },
      {
        "level": 3,
        "text": "Steam WebAPI Token Extension",
        "anchor": "pd-trade-tracking--heading-32",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#roll"
      },
      {
        "level": 2,
        "text": "Fast’s own trading interface links SIH and checks its permissions",
        "anchor": "pd-trade-tracking--heading-33",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#fast"
      },
      {
        "level": 3,
        "text": "The non-monetary label sits beside paid funding routes",
        "anchor": "pd-trade-tracking--heading-34",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#fast"
      },
      {
        "level": 3,
        "text": "The same domain appears in a final Dutch gambling-enforcement record",
        "anchor": "pd-trade-tracking--heading-35",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#fast"
      },
      {
        "level": 3,
        "text": "CSGOFast, SIH and the commercial control that survived",
        "anchor": "pd-trade-tracking--heading-36",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#fast"
      },
      {
        "level": 2,
        "text": "What the three implementations establish",
        "anchor": "pd-trade-tracking--heading-37",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#comparison"
      },
      {
        "level": 3,
        "text": "CSGOEmpire",
        "anchor": "pd-trade-tracking--heading-38",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#comparison"
      },
      {
        "level": 3,
        "text": "CSGORoll",
        "anchor": "pd-trade-tracking--heading-39",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#comparison"
      },
      {
        "level": 3,
        "text": "CSGOFast / SIH integration",
        "anchor": "pd-trade-tracking--heading-40",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#comparison"
      },
      {
        "level": 3,
        "text": "The technical evidence explains the dependence that the collectibles analogy omits",
        "anchor": "pd-trade-tracking--heading-41",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#comparison"
      },
      {
        "level": 3,
        "text": "What the operators still owe their users",
        "anchor": "pd-trade-tracking--heading-42",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#comparison"
      },
      {
        "level": 2,
        "text": "Package. File. Location.",
        "anchor": "pd-trade-tracking--heading-43",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#code-record"
      },
      {
        "level": 2,
        "text": "Read the underlying records.",
        "anchor": "pd-trade-tracking--heading-44",
        "source_url": "https://phishdestroy.io/steam_dossier/trade-tracking#sources"
      }
    ],
    "links": [
      {
        "label": "Live article",
        "url": "https://phishdestroy.io/steam_dossier/trade-tracking"
      },
      {
        "label": "Read the physical-ownership comparison ↗",
        "url": "https://phishdestroy.io/steam_dossier/valve-and-enforcement.html#collectibles"
      },
      {
        "label": "Original 11 October edition · complete text →",
        "url": "https://phishdestroy.io/steam_dossier/editions/2026-10-11-latest/trade-tracking.html"
      },
      {
        "label": "See the account-count comparison ↗",
        "url": "https://phishdestroy.io/steam_dossier/money-and-enforcement.html#account-counts"
      },
      {
        "label": "Read the documentary findings ↗",
        "url": "https://phishdestroy.io/steam_dossier/aml-data.html#record"
      },
      {
        "label": "NEW CASE / VALVE’S 2016 ENFORCEMENT CLAIMCSGOFast, SIH and the commercial control that survivedFive interface exhibits, 33 code locations, authenticator custody and the record before the commission.↗",
        "url": "https://phishdestroy.io/steam_dossier/csgofast-sih.html"
      },
      {
        "label": "Open this passage in the complete original edition →",
        "url": "https://phishdestroy.io/steam_dossier/editions/2026-10-11-latest/trade-tracking.html#fast"
      },
      {
        "label": "Original three-column credential comparison ↗",
        "url": "https://phishdestroy.io/steam_dossier/steam-access.html#access"
      },
      {
        "label": "Valve’s response and the ownership comparison ↗",
        "url": "https://phishdestroy.io/steam_dossier/valve-and-enforcement.html#us-lawsuit"
      },
      {
        "label": "Why the transfer-safeguard reference matters ↗",
        "url": "https://phishdestroy.io/steam_dossier/aml-data.html#finding-shield"
      },
      {
        "label": "Download evidence record ↗",
        "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/trade-tracking-2026-10-10/audit-record.json"
      },
      {
        "label": "Manifest ↗",
        "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/trade-tracking-2026-10-10/empire-manifest.json"
      },
      {
        "label": "Fixture results ↗",
        "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/trade-tracking-2026-10-10/offline-checks.json"
      },
      {
        "label": "CSGOEmpire — Trade Tracking — Desktop ↗",
        "url": "https://help.csgoempire.com/en/articles/10738502-trade-tracking-desktop-guide"
      },
      {
        "label": "CSGOEmpire — Trade Tracking — Mobile ↗",
        "url": "https://help.csgoempire.com/en/articles/15830596-trade-tracking-mobile-guide"
      },
      {
        "label": "CSGOEmpire — How the P2P system works ↗",
        "url": "https://help.csgoempire.com/en/articles/5341467-how-does-the-p2p-player-to-player-system-work"
      },
      {
        "label": "CSGOEmpire — How prices are calculated ↗",
        "url": "https://help.csgoempire.com/en/articles/5374190-how-are-prices-calculated"
      },
      {
        "label": "CSGOEmpire — Editing a listing price ↗",
        "url": "https://help.csgoempire.com/en/articles/5341471-how-do-i-edit-my-listing-price"
      },
      {
        "label": "CSGOEmpire — Trade protection update ↗",
        "url": "https://help.csgoempire.com/en/articles/11792613-trade-protection-update"
      },
      {
        "label": "CSGOEmpire — Skin Trading Policy ↗",
        "url": "https://help.csgoempire.com/en/articles/14831414-skin-trading-policy"
      },
      {
        "label": "CSGOEmpire — Trade punishments ↗",
        "url": "https://help.csgoempire.com/en/articles/5276311-trade-punishments"
      },
      {
        "label": "CSGOEmpire — Instant Credit Limit ↗",
        "url": "https://help.csgoempire.com/en/articles/11916422-instant-credit-limit"
      },
      {
        "label": "CSGOEmpire — When an item is charged ↗",
        "url": "https://help.csgoempire.com/en/articles/6100786-when-am-i-charged-for-an-item"
      },
      {
        "label": "CSGOEmpire — Withdrawing Counter-Strike items ↗",
        "url": "https://help.csgoempire.com/en/articles/5341485-how-do-i-withdraw-counter-strike"
      },
      {
        "label": "CSGOEmpire — Cancelling a withdrawal ↗",
        "url": "https://help.csgoempire.com/en/articles/7436880-can-i-cancel-a-withdrawal"
      },
      {
        "label": "CSGOEmpire — Cancelling an active trade ↗",
        "url": "https://help.csgoempire.com/en/articles/5341518-can-i-cancel-an-active-trade"
      },
      {
        "label": "CSGOEmpire — Item privacy toggle ↗",
        "url": "https://help.csgoempire.com/en/articles/10508998-item-privacy-toggle"
      },
      {
        "label": "CSGOEmpire — Trading fees ↗",
        "url": "https://help.csgoempire.com/en/articles/8494315-are-there-any-trading-fees"
      },
      {
        "label": "CSGOEmpire — Wagering to withdraw skins ↗",
        "url": "https://help.csgoempire.com/en/articles/5366975-do-i-need-to-wager-to-withdraw-counter-strike-skins"
      },
      {
        "label": "CSGOEmpire — Withdrawal duration ↗",
        "url": "https://help.csgoempire.com/en/articles/5494493-how-long-does-a-withdrawal-take-counter-strike"
      },
      {
        "label": "CSGOEmpire — Auction listings and limits ↗",
        "url": "https://help.csgoempire.com/en/articles/8460197-auction-listings-limits"
      },
      {
        "label": "CSGOEmpire — Thirty-minute auction update ↗",
        "url": "https://help.csgoempire.com/en/articles/9117575-30-minute-auction-update-8th-may-2024"
      },
      {
        "label": "CSGOEmpire — Depositing Counter-Strike items ↗",
        "url": "https://help.csgoempire.com/en/articles/5341470-how-do-i-deposit-counter-strike"
      },
      {
        "label": "CSGOEmpire — Telegram and Discord notifications ↗",
        "url": "https://help.csgoempire.com/en/articles/5376331-how-do-i-set-up-telegram-or-discord-notifications"
      },
      {
        "label": "CSGOEmpire — Updating a trade URL ↗",
        "url": "https://help.csgoempire.com/en/articles/5367000-how-do-i-update-my-trade-url"
      },
      {
        "label": "CSGOEmpire — Counter-Strike deposits and withdrawals ↗",
        "url": "https://help.csgoempire.com/en/collections/2918572-counter-strike-deposits-withdrawals"
      },
      {
        "label": "Trade Token Sync — Chrome Web Store ↗",
        "url": "https://chromewebstore.google.com/detail/trade-token-sync/kbcomfmcakpckijlmbkglflflmokhgof"
      },
      {
        "label": "Trade Token Sync — Google update-service package ↗",
        "url": "https://clients2.google.com/service/update2/crx?response=redirect&prodversion=140.0.0.0&acceptformat=crx2%2Ccrx3&x=id%3Dkbcomfmcakpckijlmbkglflflmokhgof%26uc"
      },
      {
        "label": "Privacy notice linked by Trade Token Sync ↗",
        "url": "https://pastebin.com/DgU7152m"
      },
      {
        "label": "CSGORoll — WebAPI Trading Extension ↗",
        "url": "https://www.csgoroll.com/blog/csgoroll-trading-extension/"
      },
      {
        "label": "CSGORoll — current extension redirect ↗",
        "url": "https://csgoroll.com/extension"
      },
      {
        "label": "Older CSGORoll extension — Google update response ↗",
        "url": "https://clients2.google.com/service/update2/crx?response=redirect&prodversion=140.0.0.0&acceptformat=crx2%2Ccrx3&x=id%3Dcgkgfnlnpcifjnbfdbmcphcgnkeinjpd%26uc"
      },
      {
        "label": "Current CSGORoll extension — Google package ↗",
        "url": "https://clients2.google.com/service/update2/crx?response=redirect&prodversion=140.0.0.0&acceptformat=crx2%2Ccrx3&x=id%3Dbdgacfnoihldeemdcbggkgmjgdfcliah%26uc"
      },
      {
        "label": "CSGORoll — Steam WebAPI Token help ↗",
        "url": "https://intercom.help/csgoroll/en/articles/12033745-steam-webapi-token"
      },
      {
        "label": "Chrome — Declare permissions ↗",
        "url": "https://developer.chrome.com/docs/extensions/develop/concepts/declare-permissions"
      },
      {
        "label": "Chrome — Cookies API ↗",
        "url": "https://developer.chrome.com/docs/extensions/reference/api/cookies"
      },
      {
        "label": "Chrome — Extension service worker lifecycle ↗",
        "url": "https://developer.chrome.com/docs/extensions/develop/concepts/service-workers/lifecycle"
      },
      {
        "label": "CSGOFast — Responsible Play Policy ↗",
        "url": "https://csgofast.com/responsible-play-policy"
      },
      {
        "label": "CSGOFast — AML Policy ↗",
        "url": "https://csgofast.com/aml-policy"
      },
      {
        "label": "CSGOFast — FAQ ↗",
        "url": "https://csgofast.com/faq"
      },
      {
        "label": "CSGOFast — P2P frontend component ↗",
        "url": "https://csgofast.com/chunk-4OFQKOVU.js"
      },
      {
        "label": "CSGOFast — SIH installation and permission component ↗",
        "url": "https://csgofast.com/chunk-4J5LYWSH.js"
      },
      {
        "label": "CSGOFast — client service bundle ↗",
        "url": "https://csgofast.com/chunk-2FZZMIT7.js"
      },
      {
        "label": "Dutch Ksa — Gamusoft LP / csgofast.com ↗",
        "url": "https://kansspelautoriteit.nl/gamusoft-lp"
      },
      {
        "label": "PhishDestroy — earlier Roll and SIH code audit ↗",
        "url": "https://phishdestroy.io/steam_dossier/extension-audit.html"
      },
      {
        "label": "CSGOFast — public application entry bundle ↗",
        "url": "https://csgofast.com/main-JJ4ULN5H.js"
      },
      {
        "label": "CSGOFast — SIH modal import module ↗",
        "url": "https://csgofast.com/chunk-WXK6SRSN.js"
      },
      {
        "label": "Chrome — Content scripts ↗",
        "url": "https://developer.chrome.com/docs/extensions/develop/concepts/content-scripts"
      },
      {
        "label": "Older CSGORoll extension — store URL ↗",
        "url": "https://chromewebstore.google.com/detail/cgkgfnlnpcifjnbfdbmcphcgnkeinjpd"
      }
    ],
    "tables": [],
    "cited_source_ids": []
  },
  "resources": [
    {
      "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/trade-tracking-2026-10-10/audit-record.json",
      "sha256": "f25bdf2d179d5f4a617a7117f51a42636c49d9ed4f04983001a8dd71f5933893",
      "bytes": 170253
    },
    {
      "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/trade-tracking-2026-10-10/empire-manifest.json",
      "sha256": "367cebed484e3007511fefed990fffbffa6509f6b2ca1354696a75fb3953931f",
      "bytes": 1306
    },
    {
      "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/trade-tracking-2026-10-10/offline-checks.json",
      "sha256": "a2b345d76e1d470e0c7984368fbb8406c3b7dde9516d650172ffb54d73319dbb",
      "bytes": 1345
    }
  ]
}