Download File

 # Anti-Dupe ## Overview **Anti-Dupe 3.3** is an advanced anti-duplication and server-security system for Paper Minecraft servers. Rather than relying solely on periodic inventory scanning, Anti-Dupe combines: - Transaction ledger accounting - Immediate event verification - Cross-inventory auditing - Trusted transaction authorization - UUID tracking - Stack-safe accounting - Automatic chunk scanning - Deep inventory auditing - Safe recovery and rollback systems - Operator and Creative Mode protection - High-speed movement stabilization - Cross-inventory confirmation - Discord notifications - Multi-language support Anti-Dupe is designed to protect both vanilla and heavily customized servers while minimizing interference with legitimate gameplay. The goal is simple: > **Legitimate item movement should remain invisible to players, while unauthorized item creation should be detected, preserved for review, and safely removed.** --- # Core Features - Immediate event-based verification - Hybrid inventory scanning - Transaction Ledger - Trusted Transaction Framework - Trusted Plugin Whitelisting - Shop Plugin Compatibility - Stack-safe accounting - UUID tracking for unique items - Cross-inventory duplicate detection - Cross-inventory confirmation system - High-speed movement stabilization - Stale container protection - Automatic chunk scanning - Deep inventory auditing - Safe removal & recovery - Inventory rollback system - SQLite transaction database - Database migration support - Network support architecture for Velocity/Bungee - World-aware protection rules - Exploit fingerprint system - Daily rotating log files - Discord webhook alerts - Multi-language support - Console verbosity controls - Administrator whitelist - Operator protection - Creative Mode protection - Original item preservation - Bundle transaction protection - Crafting workstation transaction handling - bStats metrics support --- # Trusted Transaction Framework One of Anti-Dupe's core systems is the **Trusted Transaction Framework**. Instead of assuming every increase in inventory is suspicious, Anti-Dupe attempts to determine **why** an item was created before enforcement occurs. Legitimate item generation can be authorized by trusted systems including: - Shop plugins - Economy plugins - Reward systems - Custom inventories - Other approved transaction sources This significantly reduces false positives while maintaining duplicate detection for unauthorized item creation. --- # Trusted Plugin Compatibility Anti-Dupe does **not** automatically trust every custom inventory. Transactions are considered trusted only when the configured compatibility requirements are met. Example: ```yaml compatibility: external-plugin-inventories: enabled: true grace-delay-ticks: 4 trusted-plugins: - UltimateShop title-patterns: - shop - store - market ``` Additional trusted plugins may be added: ```yaml trusted-plugins: - UltimateShop - EconomyShopGUI - ShopGUIPlus ``` Inventory title matching is case-insensitive. The default approved title patterns remain intentionally limited to: ```yaml title-patterns: - shop - store - market ``` This reduces the attack surface compared with blindly trusting custom inventories. --- # ⚠️⚠️⚠️ Trusted Plugin Security Warning ⚠️⚠️⚠️ Adding a plugin to `trusted-plugins` tells Anti-Dupe to accept qualifying transactions originating from that plugin as legitimate. **This creates an intentional trust boundary.** If a trusted plugin contains: - A duplication glitch - Item-generation bug - Transaction exploit - Reward exploit - Shop exploit - Crate exploit - Auction exploit - Economy exploit Anti-Dupe may treat the resulting items as legitimate because they originated from a source explicitly trusted by the administrator. For example: ```text Trusted Shop Plugin ↓ Plugin bug generates 64 items instead of 1 ↓ Anti-Dupe sees an authorized transaction ↓ Ledger may accept the increase ``` Anti-Dupe cannot reliably protect a server from a system the administrator has explicitly instructed it to trust. Only whitelist plugins that you: - Fully trust - Keep updated - Have tested carefully - Obtained from reputable sources - Actively monitor for exploit reports - Actually require to generate items Keep the trusted-plugin list **as small as possible**. Removing a plugin from `trusted-plugins` restores normal Anti-Dupe enforcement for its transactions. --- # Shop Plugin Support Anti-Dupe supports inventory-based shop systems through the Trusted Transaction Framework. Examples include: - UltimateShop - EconomyShopGUI - ShopGUIPlus - Similar inventory-based shop plugins Trusted purchases can: - Update the ledger automatically - Register newly created items - Avoid false duplicate warnings - Avoid unnecessary recovery entries - Avoid unnecessary Discord alerts - Continue protecting the player's remaining inventory --- # Immediate Event Verification Anti-Dupe verifies inventory transactions after Minecraft finishes processing them. Protected events include: - Inventory Click - Shift Click - Number Key Swap - Drag Distribution - Stack Split - Stack Merge - Double Click Collect - Offhand Swap - Hopper Transfer - Item Pickup - Item Drop - Crafting - Smithing - Anvil - Grindstone - Villager Trading - Player Login - Player Logout - Container Open - Container Close Cursor items are included in transaction snapshots to prevent normal item movement from appearing to create additional items. --- # Crafting & Workstation Protection Anti-Dupe 3.3 includes improved handling for crafting and workstation inventories. This was introduced to prevent legitimate ingredient consumption and result creation from appearing as unauthorized inventory changes. Supported transaction handling includes: - Crafting Tables - Player Crafting - Furnaces - Blast Furnaces - Smokers - Smithing Tables - Anvils - Grindstones - Brewing Stands - Crafters - Villager Trading Anti-Dupe waits for Minecraft to complete the transaction before evaluating the resulting inventory state. This prevents situations where: ```text Input exists ↓ Craft executes ↓ Output appears ↓ Input disappears ``` from temporarily being interpreted as: ```text Input exists + Output exists = Unexpected item increase ``` --- # Bundle Transaction Protection Anti-Dupe 3.3 includes special handling for Minecraft bundles. Items stored inside a vanilla bundle are considered part of the player's total ownership. Example: ```text Inventory: 32 Arrows Bundle: 32 Arrows Total ownership: 64 Arrows ``` Moving items between: ```text Bundle ↕ Cursor ↕ Player Inventory ``` does **not** represent item creation. Example configuration: ```yaml transaction-handlers: bundles: enabled: true delay-ticks: 2 include-contained-items-in-accounting: true recursive-content-check: true ``` Removing arrows from a bundle therefore does not create a false positive simply because the same items temporarily appear on the cursor or elsewhere in the inventory transaction. A genuine exploit that increases: ```text bundle + cursor + inventory ``` is still subject to normal Anti-Dupe enforcement. --- # Scanner Configuration ```yaml scanner: enabled: true online-inventory-minutes: 5 ender-chest-minutes: 10 loaded-containers-minutes: 15 uuid-crosscheck-minutes: 15 ledger-audit-minutes: 30 players-per-batch: 10 automatic-chunk-scans: true chunk-scan-delay-ticks: 20 ``` Scanner tasks are staggered to minimize server impact. --- # Scan Frequency | Scan | Default | |------|--------:| | Online Player Inventories | Every 5 minutes | | Ender Chests | Every 10 minutes | | Loaded Containers | Every 15 minutes | | Cross Inventory UUID Check | Every 15 minutes | | Ledger Audit | Every 30 minutes | Player scans are processed in configurable batches. --- # Cross-Inventory Protection Anti-Dupe compares UUID-tracked items across inventories to detect cases where the same unique item appears in multiple locations. Potential locations include: - Player inventories - Ender Chests - Chests - Barrels - Shulker Boxes - Hoppers - Furnaces - Other loaded containers - Inventory-holding entities - Chest Minecarts - Hopper Minecarts A cross-inventory detection is treated separately from normal quantity accounting. --- # High-Speed Movement Stabilization Anti-Dupe 3.3 adds additional protection against false cross-inventory detections caused by extremely rapid player movement. This is particularly important for: - Elytra flight - Nether travel - Rapid chunk transitions - Teleportation - Portal travel - World changes - Server joins - Network/server transitions At high speeds, Minecraft may rapidly load and unload chunks while Anti-Dupe is inspecting inventories. Without stabilization, a situation such as: ```text Old container observation + Player inventory ↓ Same UUID temporarily appears twice ``` could potentially look like a duplicate even though one observation is stale. Anti-Dupe therefore introduces a stabilization period before cross-inventory enforcement. Example: ```yaml cross-inventory-protection: stabilization: enabled: true after-join-ticks: 60 after-chunk-change-ticks: 10 after-world-change-ticks: 40 after-teleport-ticks: 20 after-portal-ticks: 40 high-speed: enabled: true blocks-per-second-threshold: 25.0 stabilization-ticks: 10 ``` High-speed movement does **not** exempt a player from Anti-Dupe. It only delays cross-inventory enforcement until the player's inventory and surrounding chunk state have stabilized. --- # Cross-Inventory Confirmation Cross-inventory detections can require confirmation before quarantine. Example: ```yaml cross-inventory-protection: confirmation: enabled: true delay-ticks: 3 required-matches: 2 candidate-expiry-seconds: 30 ``` Instead of: ```text Duplicate UUID observed ↓ Immediate quarantine ``` Anti-Dupe can perform: ```text Duplicate UUID observed ↓ Record candidate ↓ Wait ↓ Fresh inventory scan ↓ Duplicate still exists? / \ No Yes ↓ ↓ Discard Confirm ↓ Quarantine ``` This protects against transient inventory states without allowing genuine duplicate UUIDs to escape detection. --- # Stale Container Protection Delayed chunk scans verify that the target chunk is still loaded before scanning it. A container observation from an unloaded or invalid chunk should not be treated the same as a currently accessible live inventory. This is particularly useful when players travel rapidly through the Nether using Elytra, where large numbers of chunks can load and unload in a short period. Cross-inventory detections are designed to favor fresh, identifiable inventory evidence over stale observations. --- # Deep Scan Commands Scan everything: ```text /antidupe scan all ``` Scans: - Online players - Ender Chests - Loaded containers - Inventory-holding entities - Chest Minecarts - Hopper Minecarts - UUID registry - Stack fingerprints - Ledger totals Player inventories: ```text /antidupe scan players ``` Ender Chests: ```text /antidupe scan ender ``` Loaded containers: ```text /antidupe scan containers ``` Current chunk: ```text /antidupe scan chunk ``` --- # Automatic Chunk Scanning Whenever a chunk loads: 1. Anti-Dupe waits for the configured delay. 2. The chunk's inventory holders are inspected. 3. The chunk must still be loaded when the delayed scan executes. Default: ```yaml automatic-chunk-scans: true chunk-scan-delay-ticks: 20 ``` Supported block inventories include: - Chest - Trapped Chest - Barrel - Shulker Box - Hopper - Furnace - Blast Furnace - Smoker - Crafter - Brewing Stand - Dropper - Dispenser Supported entities include: - Chest Minecart - Hopper Minecart - Inventory-holding entities --- # Transaction Ledger Unlike traditional anti-dupe plugins, Anti-Dupe maintains an authoritative transaction ledger. Every legitimate item creation can update the ledger. Examples include: - Mining - Crafting - Smelting - Trading - Trusted shop purchases - Approved plugin transactions Unauthorized increases continue through duplicate detection. The ledger does not intentionally "learn" duplicated quantities simply because they appeared in an inventory. --- # Stack-Safe Accounting Stackable items retain normal Minecraft stacking behavior. Rather than requiring every ordinary stack to behave like a unique item, Anti-Dupe combines: - Item fingerprints - Ledger totals - Transaction accounting - Cross-inventory quantity verification This preserves vanilla stacking while detecting unauthorized quantity increases. --- # Unique Item Protection Items requiring unique tracking can receive hidden UUID information. Tracked information can include: - UUID - Player - Inventory - Slot - Timestamp - Fingerprint When the same unique UUID is confirmed in multiple independent locations: 1. Preserve the original. 2. Backup the suspected duplicate. 3. Remove the duplicate. 4. Create a recovery record. 5. Log the incident. 6. Notify administrators. 7. Send Discord notification if configured. --- # Safe Removal & Recovery Anti-Dupe uses a **backup-before-removal** policy. Before a suspected duplicate is removed, the complete ItemStack is written to: ```text plugins/Anti-Dupe/recovery.yml ``` Stored information can include: - Material - Amount - Name - Lore - Enchantments - Durability - Components - Persistent Data - Player - UUID - World - Coordinates - Detection Reason - Timestamp - Recovery ID - Restore Status If the backup fails: - The item remains untouched. - A severe error is logged. This prevents Anti-Dupe itself from permanently destroying an item that cannot first be recovered. --- # Recovery Commands Recent recovery records: ```text /antidupe recovery list ``` Records for a player: ```text /antidupe recovery player <player> ``` Restore to original owner: ```text /antidupe recovery restore <id> ``` Restore to another player: ```text /antidupe recovery restore <id> <player> ``` Permission: ```text antidupe.recovery ``` --- # Inventory Rollbacks Anti-Dupe 3.3 includes inventory rollback functionality for situations where administrators need to restore an earlier inventory state. Commands include: ```text /antidupe rollback list [player] ``` Create a snapshot: ```text /antidupe rollback snapshot ``` Restore a snapshot: ```text /antidupe rollback restore <id> [player] ``` Rollback functionality provides another recovery layer beyond individual quarantined items. --- # Administrator Whitelist Add: ```text /antidupe whitelist add <player> ``` Remove: ```text /antidupe whitelist remove <player> ``` Check: ```text /antidupe whitelist check <player> ``` List: ```text /antidupe whitelist list ``` Stored in: ```text plugins/Anti-Dupe/admin-whitelist.yml ``` Permission: ```text antidupe.whitelist ``` --- # Server Security Protection Anti-Dupe 3.3 includes optional protections against unauthorized administrative privileges. The security system can protect: - Operator status - Creative Mode access These protections use UUID-based authorization. Example: ```yaml security: enabled: false op-protection: enabled: true allowed-uuids: [] creative-protection: enabled: true allowed-uuids: [] fallback-gamemode: SURVIVAL ``` The main security system is intentionally disabled by default. Administrators should configure their UUIDs **before enabling it**. --- # Operator Protection Operator Protection prevents unauthorized players from obtaining or retaining OP status. Authorized administrators can be managed in-game. Add: ```text /antidupe opprot add <player> ``` Remove: ```text /antidupe opprot remove <player> ``` List: ```text /antidupe opprot list ``` The player's UUID is stored under: ```yaml security: op-protection: allowed-uuids: [] ``` Player names can be selected using command completion where available. UUID storage prevents simple username changes from bypassing the protection. --- # Creative Mode Protection Creative Mode can also be restricted to explicitly authorized UUIDs. Add: ```text /antidupe creativeprot add <player> ``` Remove: ```text /antidupe creativeprot remove <player> ``` List: ```text /antidupe creativeprot list ``` Stored under: ```yaml security: creative-protection: allowed-uuids: [] ``` Unauthorized Creative Mode can be reverted to the configured fallback: ```yaml fallback-gamemode: SURVIVAL ``` Permission for the security-management commands: ```text antidupe.security ``` The main `/antidupe` command also requires: ```text antidupe.admin ``` --- # ⚠️ Operator Protection Setup Warning **Configure your administrator UUIDs before enabling the main security system.** If: ```yaml security: enabled: true op-protection: enabled: true allowed-uuids: [] ``` then there are **no authorized operator UUIDs**. Anti-Dupe may therefore treat every OP player as unauthorized. The same principle applies to Creative Mode protection. Recommended setup: ```text 1. Install Anti-Dupe 2. Start the server 3. Add authorized administrators 4. Verify the UUID lists 5. Enable security 6. Restart/reload as appropriate ``` --- # Database Support Anti-Dupe uses persistent transaction storage for ledger and tracking information. SQLite provides a local database suitable for single-server installations. The database layer is designed to support migration as Anti-Dupe's schema evolves. Database migration support allows newer plugin versions to update older stored data without requiring administrators to manually rebuild the Anti-Dupe database. As with any server database, administrators should maintain regular backups. --- # Network Support Anti-Dupe 3.3 includes architecture for multi-server environments using systems such as: - Velocity - BungeeCord Network synchronization is intended to prevent an item from appearing legitimate simply because it moved between backend servers. Network-aware protection can be used to coordinate Anti-Dupe state across connected servers rather than treating every backend as an entirely independent economy. Configuration should remain optional so standalone Paper servers do not require proxy infrastructure. --- # World-Aware Rules Anti-Dupe can use world-aware protection policies so administrators can apply different rules to different environments. Examples include: - Survival worlds - Creative worlds - Event worlds - Minigame worlds - Resource worlds - Lobby worlds This is useful when a server intentionally allows behavior in one world that should never be accepted in another. Administrators should keep exemptions as narrow as possible. --- # Exploit Fingerprint Database Anti-Dupe 3.3 includes support for identifying known duplication behavior through exploit fingerprints. Rather than relying entirely on a single inventory count, exploit fingerprints can describe suspicious transaction patterns associated with known duplication techniques. Potential fingerprint information includes: - Transaction sequence - Inventory type - Item movement pattern - Timing - Quantity change - Container interaction - Repeated UUID behavior Fingerprint-based detection supplements the normal ledger, UUID, and inventory systems rather than replacing them. --- # Testing Command ```text /dupe ``` The administrator-only testing command intentionally duplicates the held item. It is designed to verify that Anti-Dupe's detection and quarantine systems are working. The test ignores: - Administrator whitelist - OP status - `antidupe.bypass` Permission: ```text antidupe.dupe ``` ⚠️ **Use `/dupe` only on a test server or in a controlled environment.** --- # Console Verbosity Anti-Dupe includes configurable console logging levels. ```yaml warnings: console: true console-verbosity: low ``` Available levels: | Level | Description | |------|-------------| | `off` | Suppresses routine Anti-Dupe console output | | `low` | Startup information and confirmed detections/removals | | `med` | Includes scheduled and manual scan summaries | | `high` | Diagnostic, testing and administrative information | Critical recovery failures can still be logged regardless of routine verbosity. Changing console verbosity does **not** disable: - Discord alerts - Recovery records - Daily logs - In-game administrator notifications This allows large servers to reduce console spam without weakening Anti-Dupe's other reporting systems. --- # Private Detection Notifications Regular players do not receive duplicate-detection warnings. Detection information is restricted to: - Server Console - Authorized Administrators - Daily Log Files - Discord Permission: ```text antidupe.notify ``` This prevents suspected exploiters from receiving detailed information about the detection system. --- # Daily Logs Location: ```text plugins/Anti-Dupe/logs/ ``` Filename: ```text anti-dupe-YYYY-MM-DD.log ``` Logs rotate automatically by date. --- # Discord Webhook Alerts Anti-Dupe supports rich Discord webhook notifications. Configuration: ```yaml discord: enabled: true webhook-url: "" username: "Anti-Dupe" avatar-url: "" locale: en_US embed-color: "#FFB000" include-coordinates: true role-mention: "" ``` Detection embeds can contain: - Player - UUID - World - Coordinates - Detection Time - Detection Reason - Removed Item - Removed Quantity - Recovery ID - Removal confirmation Webhook delivery runs asynchronously to avoid blocking the main Minecraft server thread. Discord may use a separate locale from the server's default language. --- # Console vs Discord Logging Console verbosity only controls console output. For example: ```yaml warnings: console-verbosity: off ``` does **not** disable: ```text Discord alerts Recovery records Daily logs Administrator notifications ``` This separation allows administrators to keep detailed security records while maintaining a clean server console. --- # Multi-Language Support Anti-Dupe now provides **28 locale variants**. Supported locales: | Locale | Language | |--------|----------| | 🇺🇸 `en_US` | English | | 🇩🇪 `de_DE` | German | | 🇪🇸 `es_ES` | Spanish | | 🇨🇦 `fr_CA` | French (Canada) | | 🇫🇷 `fr_FR` | French (France) | | 🇮🇹 `it_IT` | Italian | | 🇯🇵 `ja_JP` | Japanese | | 🇵🇱 `pl_PL` | Polish | | 🇧🇷 `pt_BR` | Portuguese (Brazil) | | 🇷🇺 `ru_RU` | Russian | | 🇹🇷 `tr_TR` | Turkish | | 🇺🇦 `uk_UA` | Ukrainian | | 🇨🇳 `zh_CN` | Simplified Chinese | | 🇰🇷 `ko_KR` | Korean | | 🇳🇱 `nl_NL` | Dutch | | 🇨🇿 `cs_CZ` | Czech | | 🇮🇩 `id_ID` | Indonesian | | 🇹🇼 `zh_TW` | Traditional Chinese (Taiwan) | | 🇸🇪 `sv_SE` | Swedish | | 🇳🇴 `no_NO` | Norwegian | | 🇩🇰 `da_DK` | Danish | | 🇫🇮 `fi_FI` | Finnish | | 🇷🇴 `ro_RO` | Romanian | | 🇭🇺 `hu_HU` | Hungarian | | 🇬🇷 `el_GR` | Greek | | 🇸🇦 `ar_SA` | Arabic | | 🇮🇱 `he_IL` | Hebrew (Israel) | | 🇮🇳 `hi_IN` | Hindi (India) | Configuration: ```yaml language: default: en_US use-client-locale: true ``` Language files: ```text plugins/Anti-Dupe/lang/ ``` When client-locale support is enabled, Anti-Dupe can use the player's supported locale where appropriate. Unsupported client locales can fall back to the configured default language. --- # New Languages Added Anti-Dupe's international support has been substantially expanded. The following locales were added: - 🇰🇷 `ko_KR` — Korean - 🇳🇱 `nl_NL` — Dutch - 🇨🇿 `cs_CZ` — Czech - 🇮🇩 `id_ID` — Indonesian - 🇹🇼 `zh_TW` — Traditional Chinese (Taiwan) - 🇸🇪 `sv_SE` — Swedish - 🇳🇴 `no_NO` — Norwegian - 🇩🇰 `da_DK` — Danish - 🇫🇮 `fi_FI` — Finnish - 🇷🇴 `ro_RO` — Romanian - 🇭🇺 `hu_HU` — Hungarian - 🇬🇷 `el_GR` — Greek - 🇸🇦 `ar_SA` — Arabic - 🇮🇱 `he_IL` — Hebrew (Israel) - 🇮🇳 `hi_IN` — Hindi (India) This expands Anti-Dupe well beyond its original language set and makes administration easier for international server communities. --- # Administrator README Anti-Dupe includes administrator documentation with the plugin resources. The README provides local reference information for: - Security configuration - OP protection - Creative protection - Trusted plugins - Recovery - Inventory rollback - Deep scanning - Console verbosity - Testing - Bundle handling Localized README files can also be provided alongside supported language resources. --- # bStats Metrics Anti-Dupe includes support for **bStats** anonymous plugin metrics. Metrics are intended to provide general usage information useful for understanding Anti-Dupe adoption and compatibility. Metrics should never be used as part of duplicate enforcement. Server administrators can control bStats through the normal bStats configuration system. --- # Permissions ```text antidupe.admin antidupe.notify antidupe.whitelist antidupe.recovery antidupe.dupe antidupe.bypass antidupe.security ``` Individual installations may expose additional permissions for specific administrative functionality. --- # Recommended Deployment For a new installation, begin in: ```yaml mode: AUDIT ``` Before enabling automatic quarantine, test normal server activity extensively. Test: - Crafting - Player crafting - Furnaces - Blast Furnaces - Smokers - Smithing - Anvils - Grindstones - Brewing - Villager Trading - Shops - Trusted plugins - Hoppers - Ender Chests - Chests - Barrels - Shulker Boxes - Bundles - Stack Splitting - Stack Merging - Item Pickup - Item Drop - Elytra flight - High-speed Nether travel - Portals - Teleports - Chunk loading - Modded/custom containers - Proxy/server transfers where applicable Administrators should also test: ```text /dupe ``` to verify intentional duplicate detection. After normal gameplay has been validated: ```yaml mode: QUARANTINE ``` --- # Quarantine Workflow When Anti-Dupe confirms an unauthorized duplicate: ```text Suspicious item detected ↓ Verify transaction ↓ Confirm duplicate ↓ Preserve original ↓ Backup duplicate ↓ Create recovery record ↓ Remove duplicate ↓ Update logs ↓ Notify administrators ↓ Send Discord alert ``` The administrator can then review the incident and restore the item if the detection was a false positive. --- # False Positive Protection Philosophy Anti-Dupe is designed around the principle that: > **Detection confidence is more important than immediately deleting a suspicious item.** Where possible, Anti-Dupe attempts to distinguish: ```text Item movement ``` from: ```text Item creation ``` and: ```text Temporary inventory state ``` from: ```text Persistent duplicate state ``` Systems such as: - Transaction grace periods - Trusted transactions - Cursor accounting - Crafting transaction handling - Bundle accounting - Movement stabilization - Cross-inventory confirmation - Recovery backups - Inventory rollbacks exist specifically to reduce the risk of legitimate items being permanently lost.