# Anti-Dupe 3.7 — Performance & Lag Safety Anti-Dupe 3.7 delivers a major performance overhaul based on live server profiling. ## Performance Improvements - Moved canonical signed-item location writes off the main server thread. - Added asynchronous, bounded, and coalesced database updates. - Stable item locations and healthy ledger quantities now generate zero database writes. - Persistent global-ledger reconciliation now runs through a separate maintenance connection. - Inventory collection and scan finalization are distributed safely across multiple ticks. - Scheduled, automatic, and administrator-requested scans now share the same bounded queue. - Optional background work shares a configurable per-tick time allowance. - Scanning automatically pauses during low TPS or high MSPT and resumes when the server recovers. - Duplicate confirmation no longer performs an unrestricted same-tick inventory rescan. - Pending database and scanning work is bounded to prevent unlimited backlogs. The workload that exposed the previous scanner and SQLite bottlenecks was retested after these changes and maintained **19–20 TPS with 0–3 ms player ping**. Results will naturally vary depending on hardware, player count, plugins, configuration, and database backend. ## Detection Improvements - Newest signed-item locations take effect immediately while database persistence completes. - Older scan observations cannot overwrite newer canonical locations. - Conflicting fingerprints cannot rebind an existing signed-item UUID. - Moved duplicate candidates trigger a bounded follow-up scan instead of an expensive immediate world rescan. - Time budgeting delays optional work when necessary without intentionally reducing the configured detection scope. ## Upgrade Instructions 1. Stop the server completely. 2. Remove every older Anti-Dupe JAR from the `plugins` folder. 3. Install `Anti-Dupe-3.7.jar`. 4. Perform a full server restart. 5. Keep the existing configuration, database, recovery records, and `identity.key`. 6. Compare your configuration with the bundled `config.yml` to review the new performance settings. When network mode is enabled, upgrade every Paper backend together and ensure they continue sharing the same identity key and database.

# Anti-Dupe 3.6 Anti-Dupe 3.6 delivers improved detection accuracy, world-level control, plugin compatibility and performance. ## 🌍 Per-World Enforcement Every world can independently use `disabled`, `audit`, `quarantine`, or inherit the global mode. World policies now cover: - Live inventory transactions - Delayed confirmation checks - Player inventories and Ender Chests - Loaded storage containers - Signed item identities - Cross-inventory UUID scanning This makes temporary-kit PvP arenas and minigame worlds easy to isolate while maintaining full protection in survival worlds. ## 🎯 Accurate Item Pickups Ground pickups now receive exact item-and-quantity receipts. Items collected while another inventory action is being checked are recognized as legitimate transfers. Only the amount actually collected is authorized, meaning additional unexplained quantity remains detectable. Mined block drops are also registered as legitimate persistent-ledger supply. ## 🤝 Improved Plugin Compatibility - Trusted custom-GUI plugins no longer require title patterns. - SmartSpawner virtual-storage withdrawals are supported. - Anti-Dupe recovery menus are completely exempt from detection. - Double chests and their open views share one physical-storage identity. - Trusted GUI receipts authorize only items received by the player. ## 🔎 Investigation and Recovery 🩹 **Players → Incidents → Incident Items** Each incident can include: - World and exact coordinates - Nearby players - Nine-chunk redstone and storage audit - Previous ten offender commands - Individually restorable items - Restore All and Back controls Items are always backed up before enforcement. ## 🕵️ Detection Improvements - Persistent global quantity ledger - HMAC-signed unique-item identities - Two-stage enforcement - Atomic network transfer claims - Exact item-boundary receipts - Expanded detection simulation suite ## 📈 Performance Background scans are batched, time-budgeted, and automatically deferred during low TPS. Live protection and confirmed enforcement remain active.

# Anti-Dupe 3.5 ## Advanced item-duplication protection for Paper servers **Anti-Dupe 3.5** combines live transaction verification, persistent quantity accounting, signed unique-item identities, cross-inventory scanning, and safe administrator recovery in one complete Paper security system. It is designed for vanilla and customized servers that need strong detection without making everyday inventory management difficult. > **Verify item creation, preserve the original, secure the evidence, and give staff > a fast way to review and restore anything they need.** --- # What Is New in 3.5 Anti-Dupe 3.5 greatly expands incident forensics. When a dupe happens, staff can now determine **Who / What / When / Where**, while the new **Chunk Audit** and **Command Audit** provide evidence that may help explain **why and how** the duplication occurred. New incidents now record: - Backend server, world, and precise coordinates - Nearby players within 32 blocks - Player UUID, distance, and optional game mode - Subject-versus-nearby incident history - Repeat nearby-appearance counts - A fixed **3×3 chunk audit area**: the offender's chunk plus all eight neighbouring chunks - Redstone, mechanisms, storage blocks, exact coordinates, and totals - The offender's last **10 player-issued commands** when an incident begins - Commands displayed newest-first with timestamps and allowed/cancelled state - Automatic redaction of passwords, PINs, OTPs, tokens, and authentication arguments   The 3.5 release also includes: - Player → incidents → incident-items recovery workflow - Individual and incident-wide restoration - Back navigation throughout the recovery interface - Persistent global quantity ledger - HMAC-SHA256 signed identities for unique items - Automatic version-1 to version-2 identity migration - Two-stage enforcement using independent confirmation reads - Atomic cross-server inventory transfers - Exclusive database-backed player leases - One-time network transfer claims and inventory hashes - Trusted-plugin authorization without inventory-title patterns - Holderless custom-GUI attribution - Full exemption for Anti-Dupe-owned menus - Combined inventory, cursor, and material-level conservation - Automated detection simulations and regression testing - SQLite, MySQL, MariaDB, and PostgreSQL support --- # Lag Reduction and Further Optimization Anti-Dupe 3.5 continues to spread expensive work across multiple ticks and avoids unnecessary repeated scans. The goal is to preserve strong detection and forensic evidence while minimizing impact on TPS and normal gameplay. Performance and lag-reduction measures include: - **One chunk per tick** processing for 3×3 incident chunk audits - Staggered scheduled scans instead of running every audit simultaneously - Configurable batching for player, Ender Chest, container, UUID, and ledger scans - Delayed chunk scans that confirm a chunk is still loaded before inspecting it - Two-stage enforcement that lets transactions settle before performing confirmation reads - Movement stabilization for joins, teleports, portals, world changes, rapid chunk transitions, and high-speed Elytra travel - Asynchronous Discord webhook delivery after evidence has been saved and enforcement completed - Focused 3×3 incident auditing instead of unrestricted world-wide mechanism scanning - Bounded command history collection limited to the last 10 player-issued commands per incident - Persistent database-backed ledger, recovery, and network-transfer state to avoid unnecessary reconstruction work Together, these optimizations keep heavier forensic work bounded and distribute it over time, reducing single-tick workload while retaining the information administrators need to investigate duplication incidents. --- # Core Features - Immediate inventory transaction verification - Persistent authorized-supply accounting - Stack-safe canonical item fingerprints - Signed UUID identities for non-stackable items - Cross-inventory duplicate detection - Two-stage confirmation before normal quarantine - Player, Ender Chest, container, and entity scanning - Automatic delayed chunk scanning - High-speed movement and chunk-transition stabilization - Trusted shop and reward-plugin compatibility - Crafting and workstation transaction handlers - Bundle and nested-item accounting - Monitored plugin-command transfers - Plugin-managed storage auditing - Safe item recovery and complete inventory rollback - World-specific audit and quarantine rules - Velocity and BungeeCord backend coordination - Known exploit-pattern classification - Private staff notifications and daily logs - Discord webhook alerts - 28 locale variants - Operator and Creative Mode protection - Administrator testing tools --- # Detection Architecture Anti-Dupe does not depend on one periodic scan or one piece of item metadata. Version 3.5 combines several independent evidence layers: ```text Live Transaction Verification + Persistent Quantity Ledger + Signed Unique Identities + Cross-Inventory Scanning + Independent Confirmation ↓ Confirmed Incident Evidence ``` This lets Anti-Dupe distinguish ordinary item movement from actual quantity creation while retaining strong evidence for administrator review. --- # Persistent Global Quantity Ledger Anti-Dupe maintains a persistent authorized-supply ceiling for every observed stackable fingerprint. The first complete startup scan establishes the existing supply. After that, validated vanilla outputs and approved trusted-plugin grants add idempotent authorization records to the configured database. Repeated global observations above authorized supply become confirmed ledger incidents. Global reconciliation currently operates as a reporting layer, allowing staff to investigate confirmed excess before applying broader enforcement to servers with custom item-generation plugins. ```yaml persistent-global-ledger: enabled: true startup-baseline-delay-ticks: 40 learning-period-minutes: 1440 required-matching-scans: 2 ``` The ledger persists across restarts and never authorizes a transaction twice when the same transaction ID is replayed. --- # Signed Unique-Item Identities Non-stackable items receive a hidden serial UUID protected by HMAC-SHA256. The signature authenticates: - Identity version - Unique serial UUID - Issuing server Names, damage, repairs, enchantments, and other legitimate item changes are tracked separately, so the stable signed identity can continue to follow the same item. Version 3.5 automatically upgrades unsigned legacy items and authentic version-1 identities to the current version-2 format. The signing key is generated at: ```text plugins/Anti-Dupe/identity.key ``` Back up this file. Every backend in a network must use the same identity key. --- # Two-Stage Enforcement Normal quantity and identity detections require independent confirmation. ```text First Observation ↓ Record Candidate ↓ Wait for the Transaction to Settle ↓ Read Fresh Inventory State ↓ Evidence Still Present? / \ No Yes ↓ ↓ Clear Confirm ↓ Backup and Quarantine ``` ```yaml two-stage-enforcement: enabled: true required-matches: 2 confirmation-delay-ticks: 3 candidate-expiry-seconds: 30 ``` The administrator-only `/dupe` diagnostic remains immediate so staff can verify the configured enforcement mode on demand. --- # Transaction and Material Conservation Inventory clicks are evaluated across the complete transaction scope: - Top inventory - Player inventory - Cursor/carried item - Nested bundle contents Anti-Dupe also verifies the combined material quantity. A fingerprint transition with no material increase is treated as an item-state change, while genuine quantity growth continues through confirmation. Protected transaction families include: - Inventory click and drag - Pickup All and Place All - Shift-click and number-key transfers - Stack split, merge, and double-click collection - Offhand swaps - Hopper transfers - Crafting Tables and player crafting - Furnaces, Blast Furnaces, and Smokers - Smithing Tables, Anvils, and Grindstones - Brewing Stands and Crafters - Stonecutters, Cartography Tables, and Looms - Villager trading - Bundle transfers - Player joins and network transitions - Monitored plugin commands - Plugin-managed storage open and close operations --- # Trusted Plugin Compatibility Trusted shops, crates, quests, rewards, and other approved systems can authorize the items they legitimately grant. ```yaml compatibility: external-plugin-inventories: enabled: true grace-delay-ticks: 4 trusted-plugins: - UltimateShop - EconomyShopGUI - ShopGUIPlus ``` Trust is based on the plugin that owns or opens the custom inventory. **GUI titles are not used as a trust requirement.** Holderless custom menus are attributed from the plugin call that opened them. Physical inventories such as chests, barrels, player inventories, and entity inventories remain under normal verification. Accepted trusted grants: - Update transaction history - Add authorized supply to the global ledger - Normalize signed identities when required - Keep the rest of the player's inventory protected > ⚠️ **Trusted Plugin Warning:** A trusted plugin becomes an intentional item-creation > authority. Keep this list small, use reputable plugins, and monitor their security > updates. --- # Crafting and Workstation Protection Virtual result previews are handled separately from owned inventory contents. Anti-Dupe validates consumed inputs and authorizes the corresponding output only after Minecraft has completed the transaction. This includes shift-crafted output, crafting remainder items, repeated villager trades, and workstation result collection. --- # Bundle Protection Items inside vanilla bundles remain part of the player's total ownership. ```text Bundle Contents ↕ Cursor ↕ Player Inventory ``` Moving an item between these locations conserves the total. Recursive accounting can also inspect nested supported contents. ```yaml transaction-handlers: bundles: enabled: true delay-ticks: 2 include-contained-items-in-accounting: true recursive-content-check: true ``` --- # Cross-Inventory Protection Anti-Dupe compares signed UUIDs across: - Player inventories - Ender Chests - Chests and Trapped Chests - Barrels and Shulker Boxes - Hoppers - Furnaces, Smokers, and Blast Furnaces - Brewing Stands - Droppers and Dispensers - Crafters - Chest and Hopper Minecarts - Other loaded inventory-holding entities If the same identity is confirmed in independent live locations, Anti-Dupe preserves the registered original, backs up the conflicting copy, creates a recovery incident, and applies the configured world policy. Movement stabilization accounts for joins, teleports, portals, world changes, rapid chunk transitions, and high-speed Elytra travel before cross-inventory enforcement. --- # Automatic and Manual Scanning Scheduled scans are staggered and processed in configurable batches. | Scan | Default Interval | |------|-----------------:| | Online Player Inventories | 5 minutes | | Ender Chests | 10 minutes | | Loaded Containers | 15 minutes | | Cross-Inventory UUID Check | 15 minutes | | Ledger Audit | 30 minutes | Manual commands: ```text /antidupe scan all /antidupe scan players /antidupe scan ender /antidupe scan containers /antidupe scan chunk ``` Delayed chunk scans verify that a chunk is still loaded before inspecting it, keeping the evidence tied to a current live inventory. --- # Atomic Network Transfers Anti-Dupe 3.5 provides database-backed coordination for Velocity and BungeeCord networks. When a player leaves a backend, Anti-Dupe commits: - A unique transfer ID - The source and destination state - An ordered SHA-256 inventory hash - Storage slots - Armor slots - Offhand slot - Ender Chest slots - Transfer expiry information The destination must atomically claim the transfer and present the matching arrival hash. Player leases prevent the same player inventory from being active on two backends at once, and each transfer can be claimed only once. Network requirements: - Install Anti-Dupe on every Paper backend - Use one shared MySQL, MariaDB, or PostgreSQL database - Give every backend a unique `network.server-id` - Use the same `identity.key` or shared signing secret everywhere ```yaml network: enabled: false proxy: NONE server-id: survival-1 player-lease-seconds: 45 reject-join-while-locked: true inventory-mismatch-action: KICK shared-ledger: true cross-server-uuid-checks: true cross-server-stack-accounting: true ``` Standalone Paper servers can leave network mode disabled. --- # Inventory Rollbacks Anti-Dupe can store complete player snapshots containing inventory storage, armor, offhand, and Ender Chest contents. ```text /antidupe rollback list [player] /antidupe rollback snapshot /antidupe rollback restore <id> [player] ``` Rollback snapshots complement item-level recovery when staff need to restore a broader inventory state. --- # World-Aware Rules Different worlds can use different policies: ```yaml world-rules: enabled: true default-mode: inherit worlds: world: mode: inherit creative: mode: audit scan-ender-chest: false ``` Available world modes are: - `inherit` - `disabled` - `audit` - `quarantine` --- # Operator and Creative Protection Optional UUID-based security can restrict operator status and Creative Mode access. ```text /antidupe opprot add <player> /antidupe opprot remove <player> /antidupe opprot list /antidupe creativeprot add <player> /antidupe creativeprot remove <player> /antidupe creativeprot list ``` > ⚠️ Configure every legitimate administrator UUID before enabling OP protection. > An empty allowed list means nobody is authorized. --- # Database Support Supported database backends: - SQLite - MySQL - MariaDB - PostgreSQL SQLite is ready for standalone installations. Network mode requires all backends to share the same remote database. Automatic schema migrations preserve compatible data as Anti-Dupe evolves. --- # Private Reporting and Discord Alerts Detection details are sent to controlled administrator channels: - Paper console - Staff with `antidupe.notify` - Daily UTF-8 log files - Discord webhook, when configured Daily logs are stored under: ```text plugins/Anti-Dupe/logs/anti-dupe-YYYY-MM-DD.log ``` Discord delivery is asynchronous and occurs only after recovery evidence has been saved and enforcement has completed. Console verbosity can be changed without disabling recovery, Discord, daily logs, or staff notifications: ```text /antidupe verbosity off /antidupe verbosity low /antidupe verbosity med /antidupe verbosity high ``` --- # Multi-Language Support Anti-Dupe 3.5 includes **28 locale variants** with optional client-locale detection: `ar_SA`, `cs_CZ`, `da_DK`, `de_DE`, `el_GR`, `en_US`, `es_ES`, `fi_FI`, `fr_CA`, `fr_FR`, `he_IL`, `hi_IN`, `hu_HU`, `id_ID`, `it_IT`, `ja_JP`, `ko_KR`, `nl_NL`, `no_NO`, `pl_PL`, `pt_BR`, `ro_RO`, `ru_RU`, `sv_SE`, `tr_TR`, `uk_UA`, `zh_CN`, and `zh_TW`. ```yaml language: default: en_US use-client-locale: true ``` --- # Commands ```text /antidupe status /antidupe audit /antidupe scan <all|players|ender|containers|chunk> /antidupe recovery /antidupe recovery player <player> /antidupe recovery restore <id> [player] /antidupe rollback list [player] /antidupe rollback snapshot /antidupe rollback restore <id> [player] /antidupe whitelist add <player> /antidupe whitelist remove <player> /antidupe whitelist check <player> /antidupe whitelist list /antidupe opprot <add|remove|list> /antidupe creativeprot <add|remove|list> /antidupe verbosity <off|low|med|high> /antidupe reload /dupe ``` --- # Permissions ```text antidupe.admin antidupe.notify antidupe.whitelist antidupe.recovery antidupe.rollback antidupe.security antidupe.dupe antidupe.bypass ``` --- # Recommended Deployment Anti-Dupe requires **Paper 1.21.x** and **Java 21**. For a new installation: 1. Install the JAR and start the server once. 2. Back up `plugins/Anti-Dupe/identity.key`. 3. Configure trusted item-granting plugins. 4. Begin with `mode: AUDIT`. 5. Test your crafting, shops, rewards, containers, bundles, and network transfers. 6. Run `/dupe` in a controlled environment to verify detection. 7. Switch to `mode: QUARANTINE` when ready. Never delete or replace `identity.key` during an upgrade. Network servers must share the same key and remote database. --- # Detection Regression Suite The 3.5 source project includes **46 automated tests** covering: - Legitimate and illegitimate quantity paths - Inventory pickup/place conservation - Trusted grants - Signed-identity tampering and legacy migration - Two-stage candidate confirmation - Persistent database state across restart - Idempotent transaction authorization - Exclusive player leases - Transfer hash matching - Concurrent and replayed transfer claims Build verification also checks that the deployable shaded JAR contains `plugin.yml` and all required database drivers. --- # bStats Metrics Anti-Dupe uses bStats plugin ID **25245** for anonymous usage and configuration statistics. Custom charts do not include player names, UUIDs, IP addresses, inventory contents, recovery data, coordinates, webhook URLs, whitelist entries, or trusted plugin names. Global bStats controls are available through the standard bStats configuration. 

 # Anti-Dupe 3.4 ## Advanced item-duplication protection for Paper servers **Anti-Dupe 3.4** combines live transaction verification, persistent quantity accounting, signed unique-item identities, cross-inventory scanning, and safe administrator recovery in one complete Paper security system. It is designed for vanilla and customized servers that need strong detection without making everyday inventory management difficult. > **Verify item creation, preserve the original, secure the evidence, and give staff > a fast way to review and restore anything they need.** --- # Recovery That Is Easy to Manage Anti-Dupe 3.4 introduces a complete chest-style recovery interface built for busy server administrators. Open it with: ```text /antidupe recovery ``` The workflow is simple: ```text Players ↓ Player Incidents ↓ Incident Items ↓ Restore One Item or Restore All ``` The recovery interface provides: - Player heads for quick identification - A separate incident list for every player - Incident ID, time, reason, item count, and restoration status - Complete item previews with names, lore, enchantments, components, and durability - One-click restoration for individual entries - **Restore All** for an entire incident - Previous, Next, Refresh, Close, and **Back** controls - Clear restored timestamps and administrator attribution - Pagination for large player, incident, and item lists - Command-line restoration for console workflows and automation Every suspected item is serialized to: ```text plugins/Anti-Dupe/recovery.yml ``` Anti-Dupe follows a strict **backup-before-removal** policy. If the recovery backup cannot be saved, the item is left untouched and a critical error is logged. Administrator-restored unique items receive a fresh signed identity before they are returned. Recovery menus are fully excluded from detection, so their preview items are never treated as live inventory copies. This gives staff a straightforward safety net: open the menu, select the player, select the incident, inspect the exact items, and restore what is needed. --- # What Is New in 3.4 - Player → incidents → incident-items recovery workflow - Individual and incident-wide restoration - Back navigation throughout the recovery interface - Persistent global quantity ledger - HMAC-SHA256 signed identities for unique items - Automatic version-1 to version-2 identity migration - Two-stage enforcement using independent confirmation reads - Atomic cross-server inventory transfers - Exclusive database-backed player leases - One-time network transfer claims and inventory hashes - Trusted-plugin authorization without inventory-title patterns - Holderless custom-GUI attribution - Full exemption for Anti-Dupe-owned menus - Combined inventory, cursor, and material-level conservation - Automated detection simulations and regression testing - SQLite, MySQL, MariaDB, and PostgreSQL support --- # Core Features - Immediate inventory transaction verification - Persistent authorized-supply accounting - Stack-safe canonical item fingerprints - Signed UUID identities for non-stackable items - Cross-inventory duplicate detection - Two-stage confirmation before normal quarantine - Player, Ender Chest, container, and entity scanning - Automatic delayed chunk scanning - High-speed movement and chunk-transition stabilization - Trusted shop and reward-plugin compatibility - Crafting and workstation transaction handlers - Bundle and nested-item accounting - Monitored plugin-command transfers - Plugin-managed storage auditing - Safe item recovery and complete inventory rollback - World-specific audit and quarantine rules - Velocity and BungeeCord backend coordination - Known exploit-pattern classification - Private staff notifications and daily logs - Discord webhook alerts - 28 locale variants - Operator and Creative Mode protection - Administrator testing tools --- # Detection Architecture Anti-Dupe does not depend on one periodic scan or one piece of item metadata. Version 3.4 combines several independent evidence layers: ```text Live Transaction Verification + Persistent Quantity Ledger + Signed Unique Identities + Cross-Inventory Scanning + Independent Confirmation ↓ Confirmed Incident Evidence ``` This lets Anti-Dupe distinguish ordinary item movement from actual quantity creation while retaining strong evidence for administrator review. --- # Persistent Global Quantity Ledger Anti-Dupe maintains a persistent authorized-supply ceiling for every observed stackable fingerprint. The first complete startup scan establishes the existing supply. After that, validated vanilla outputs and approved trusted-plugin grants add idempotent authorization records to the configured database. Repeated global observations above authorized supply become confirmed ledger incidents. Global reconciliation currently operates as a reporting layer, allowing staff to investigate confirmed excess before applying broader enforcement to servers with custom item-generation plugins. ```yaml persistent-global-ledger: enabled: true startup-baseline-delay-ticks: 40 learning-period-minutes: 1440 required-matching-scans: 2 ``` The ledger persists across restarts and never authorizes a transaction twice when the same transaction ID is replayed. --- # Signed Unique-Item Identities Non-stackable items receive a hidden serial UUID protected by HMAC-SHA256. The signature authenticates: - Identity version - Unique serial UUID - Issuing server Names, damage, repairs, enchantments, and other legitimate item changes are tracked separately, so the stable signed identity can continue to follow the same item. Version 3.4 automatically upgrades unsigned legacy items and authentic version-1 identities to the current version-2 format. The signing key is generated at: ```text plugins/Anti-Dupe/identity.key ``` Back up this file. Every backend in a network must use the same identity key. --- # Two-Stage Enforcement Normal quantity and identity detections require independent confirmation. ```text First Observation ↓ Record Candidate ↓ Wait for the Transaction to Settle ↓ Read Fresh Inventory State ↓ Evidence Still Present? / \ No Yes ↓ ↓ Clear Confirm ↓ Backup and Quarantine ``` ```yaml two-stage-enforcement: enabled: true required-matches: 2 confirmation-delay-ticks: 3 candidate-expiry-seconds: 30 ``` The administrator-only `/dupe` diagnostic remains immediate so staff can verify the configured enforcement mode on demand. --- # Transaction and Material Conservation Inventory clicks are evaluated across the complete transaction scope: - Top inventory - Player inventory - Cursor/carried item - Nested bundle contents Anti-Dupe also verifies the combined material quantity. A fingerprint transition with no material increase is treated as an item-state change, while genuine quantity growth continues through confirmation. Protected transaction families include: - Inventory click and drag - Pickup All and Place All - Shift-click and number-key transfers - Stack split, merge, and double-click collection - Offhand swaps - Hopper transfers - Crafting Tables and player crafting - Furnaces, Blast Furnaces, and Smokers - Smithing Tables, Anvils, and Grindstones - Brewing Stands and Crafters - Stonecutters, Cartography Tables, and Looms - Villager trading - Bundle transfers - Player joins and network transitions - Monitored plugin commands - Plugin-managed storage open and close operations --- # Trusted Plugin Compatibility Trusted shops, crates, quests, rewards, and other approved systems can authorize the items they legitimately grant. ```yaml compatibility: external-plugin-inventories: enabled: true grace-delay-ticks: 4 trusted-plugins: - UltimateShop - EconomyShopGUI - ShopGUIPlus ``` Trust is based on the plugin that owns or opens the custom inventory. **GUI titles are not used as a trust requirement.** Holderless custom menus are attributed from the plugin call that opened them. Physical inventories such as chests, barrels, player inventories, and entity inventories remain under normal verification. Accepted trusted grants: - Update transaction history - Add authorized supply to the global ledger - Normalize signed identities when required - Keep the rest of the player's inventory protected > ⚠️ **Trusted Plugin Warning:** A trusted plugin becomes an intentional item-creation > authority. Keep this list small, use reputable plugins, and monitor their security > updates. --- # Crafting and Workstation Protection Virtual result previews are handled separately from owned inventory contents. Anti-Dupe validates consumed inputs and authorizes the corresponding output only after Minecraft has completed the transaction. This includes shift-crafted output, crafting remainder items, repeated villager trades, and workstation result collection. --- # Bundle Protection Items inside vanilla bundles remain part of the player's total ownership. ```text Bundle Contents ↕ Cursor ↕ Player Inventory ``` Moving an item between these locations conserves the total. Recursive accounting can also inspect nested supported contents. ```yaml transaction-handlers: bundles: enabled: true delay-ticks: 2 include-contained-items-in-accounting: true recursive-content-check: true ``` --- # Cross-Inventory Protection Anti-Dupe compares signed UUIDs across: - Player inventories - Ender Chests - Chests and Trapped Chests - Barrels and Shulker Boxes - Hoppers - Furnaces, Smokers, and Blast Furnaces - Brewing Stands - Droppers and Dispensers - Crafters - Chest and Hopper Minecarts - Other loaded inventory-holding entities If the same identity is confirmed in independent live locations, Anti-Dupe preserves the registered original, backs up the conflicting copy, creates a recovery incident, and applies the configured world policy. Movement stabilization accounts for joins, teleports, portals, world changes, rapid chunk transitions, and high-speed Elytra travel before cross-inventory enforcement. --- # Automatic and Manual Scanning Scheduled scans are staggered and processed in configurable batches. | Scan | Default Interval | |------|-----------------:| | Online Player Inventories | 5 minutes | | Ender Chests | 10 minutes | | Loaded Containers | 15 minutes | | Cross-Inventory UUID Check | 15 minutes | | Ledger Audit | 30 minutes | Manual commands: ```text /antidupe scan all /antidupe scan players /antidupe scan ender /antidupe scan containers /antidupe scan chunk ``` Delayed chunk scans verify that a chunk is still loaded before inspecting it, keeping the evidence tied to a current live inventory. --- # Atomic Network Transfers Anti-Dupe 3.4 provides database-backed coordination for Velocity and BungeeCord networks. When a player leaves a backend, Anti-Dupe commits: - A unique transfer ID - The source and destination state - An ordered SHA-256 inventory hash - Storage slots - Armor slots - Offhand slot - Ender Chest slots - Transfer expiry information The destination must atomically claim the transfer and present the matching arrival hash. Player leases prevent the same player inventory from being active on two backends at once, and each transfer can be claimed only once. Network requirements: - Install Anti-Dupe on every Paper backend - Use one shared MySQL, MariaDB, or PostgreSQL database - Give every backend a unique `network.server-id` - Use the same `identity.key` or shared signing secret everywhere ```yaml network: enabled: false proxy: NONE server-id: survival-1 player-lease-seconds: 45 reject-join-while-locked: true inventory-mismatch-action: KICK shared-ledger: true cross-server-uuid-checks: true cross-server-stack-accounting: true ``` Standalone Paper servers can leave network mode disabled. --- # Inventory Rollbacks Anti-Dupe can store complete player snapshots containing inventory storage, armor, offhand, and Ender Chest contents. ```text /antidupe rollback list [player] /antidupe rollback snapshot /antidupe rollback restore <id> [player] ``` Rollback snapshots complement item-level recovery when staff need to restore a broader inventory state. --- # World-Aware Rules Different worlds can use different policies: ```yaml world-rules: enabled: true default-mode: inherit worlds: world: mode: inherit creative: mode: audit scan-ender-chest: false ``` Available world modes are: - `inherit` - `disabled` - `audit` - `quarantine` --- # Operator and Creative Protection Optional UUID-based security can restrict operator status and Creative Mode access. ```text /antidupe opprot add <player> /antidupe opprot remove <player> /antidupe opprot list /antidupe creativeprot add <player> /antidupe creativeprot remove <player> /antidupe creativeprot list ``` > ⚠️ Configure every legitimate administrator UUID before enabling OP protection. > An empty allowed list means nobody is authorized. --- # Database Support Supported database backends: - SQLite - MySQL - MariaDB - PostgreSQL SQLite is ready for standalone installations. Network mode requires all backends to share the same remote database. Automatic schema migrations preserve compatible data as Anti-Dupe evolves. --- # Private Reporting and Discord Alerts Detection details are sent to controlled administrator channels: - Paper console - Staff with `antidupe.notify` - Daily UTF-8 log files - Discord webhook, when configured Daily logs are stored under: ```text plugins/Anti-Dupe/logs/anti-dupe-YYYY-MM-DD.log ``` Discord delivery is asynchronous and occurs only after recovery evidence has been saved and enforcement has completed. Console verbosity can be changed without disabling recovery, Discord, daily logs, or staff notifications: ```text /antidupe verbosity off /antidupe verbosity low /antidupe verbosity med /antidupe verbosity high ``` --- # Multi-Language Support Anti-Dupe 3.4 includes **28 locale variants** with optional client-locale detection: `ar_SA`, `cs_CZ`, `da_DK`, `de_DE`, `el_GR`, `en_US`, `es_ES`, `fi_FI`, `fr_CA`, `fr_FR`, `he_IL`, `hi_IN`, `hu_HU`, `id_ID`, `it_IT`, `ja_JP`, `ko_KR`, `nl_NL`, `no_NO`, `pl_PL`, `pt_BR`, `ro_RO`, `ru_RU`, `sv_SE`, `tr_TR`, `uk_UA`, `zh_CN`, and `zh_TW`. ```yaml language: default: en_US use-client-locale: true ``` --- # Commands ```text /antidupe status /antidupe audit /antidupe scan <all|players|ender|containers|chunk> /antidupe recovery /antidupe recovery player <player> /antidupe recovery restore <id> [player] /antidupe rollback list [player] /antidupe rollback snapshot /antidupe rollback restore <id> [player] /antidupe whitelist add <player> /antidupe whitelist remove <player> /antidupe whitelist check <player> /antidupe whitelist list /antidupe opprot <add|remove|list> /antidupe creativeprot <add|remove|list> /antidupe verbosity <off|low|med|high> /antidupe reload /dupe ``` --- # Permissions ```text antidupe.admin antidupe.notify antidupe.whitelist antidupe.recovery antidupe.rollback antidupe.security antidupe.dupe antidupe.bypass ``` --- # Recommended Deployment Anti-Dupe requires **Paper 1.21.x** and **Java 21**. For a new installation: 1. Install the JAR and start the server once. 2. Back up `plugins/Anti-Dupe/identity.key`. 3. Configure trusted item-granting plugins. 4. Begin with `mode: AUDIT`. 5. Test your crafting, shops, rewards, containers, bundles, and network transfers. 6. Run `/dupe` in a controlled environment to verify detection. 7. Switch to `mode: QUARANTINE` when ready. Never delete or replace `identity.key` during an upgrade. Network servers must share the same key and remote database. --- # Detection Regression Suite The 3.4 source project includes **46 automated tests** covering: - Legitimate and illegitimate quantity paths - Inventory pickup/place conservation - Trusted grants - Signed-identity tampering and legacy migration - Two-stage candidate confirmation - Persistent database state across restart - Idempotent transaction authorization - Exclusive player leases - Transfer hash matching - Concurrent and replayed transfer claims Build verification also checks that the deployable shaded JAR contains `plugin.yml` and all required database drivers. --- # bStats Metrics Anti-Dupe uses bStats plugin ID **25245** for anonymous usage and configuration statistics. Custom charts do not include player names, UUIDs, IP addresses, inventory contents, recovery data, coordinates, webhook URLs, whitelist entries, or trusted plugin names. Global bStats controls are available through the standard bStats configuration. 

 # Anti-Dupe ## Overview **Anti-Dupe 3.3** is an advanced anti-duplication and server-security system for Paper Minecraft servers. Rather than relying solely on periodic inventory scanning, Anti-Dupe combines: - Transaction ledger accounting - Immediate event verification - Cross-inventory auditing - Trusted transaction authorization - UUID tracking - Stack-safe accounting - Automatic chunk scanning - Deep inventory auditing - Safe recovery and rollback systems - Operator and Creative Mode protection - High-speed movement stabilization - Cross-inventory confirmation - Discord notifications - Multi-language support Anti-Dupe is designed to protect both vanilla and heavily customized servers while minimizing interference with legitimate gameplay. The goal is simple: > **Legitimate item movement should remain invisible to players, while unauthorized item creation should be detected, preserved for review, and safely removed.** --- # Core Features - Immediate event-based verification - Hybrid inventory scanning - Transaction Ledger - Trusted Transaction Framework - Trusted Plugin Whitelisting - Shop Plugin Compatibility - Stack-safe accounting - UUID tracking for unique items - Cross-inventory duplicate detection - Cross-inventory confirmation system - High-speed movement stabilization - Stale container protection - Automatic chunk scanning - Deep inventory auditing - Safe removal & recovery - Inventory rollback system - SQLite transaction database - Database migration support - Network support architecture for Velocity/Bungee - World-aware protection rules - Exploit fingerprint system - Daily rotating log files - Discord webhook alerts - Multi-language support - Console verbosity controls - Administrator whitelist - Operator protection - Creative Mode protection - Original item preservation - Bundle transaction protection - Crafting workstation transaction handling - bStats metrics support --- # Trusted Transaction Framework One of Anti-Dupe's core systems is the **Trusted Transaction Framework**. Instead of assuming every increase in inventory is suspicious, Anti-Dupe attempts to determine **why** an item was created before enforcement occurs. Legitimate item generation can be authorized by trusted systems including: - Shop plugins - Economy plugins - Reward systems - Custom inventories - Other approved transaction sources This significantly reduces false positives while maintaining duplicate detection for unauthorized item creation. --- # Trusted Plugin Compatibility Anti-Dupe does **not** automatically trust every custom inventory. Transactions are considered trusted only when the configured compatibility requirements are met. Example: ```yaml compatibility: external-plugin-inventories: enabled: true grace-delay-ticks: 4 trusted-plugins: - UltimateShop title-patterns: - shop - store - market ``` Additional trusted plugins may be added: ```yaml trusted-plugins: - UltimateShop - EconomyShopGUI - ShopGUIPlus ``` Inventory title matching is case-insensitive. The default approved title patterns remain intentionally limited to: ```yaml title-patterns: - shop - store - market ``` This reduces the attack surface compared with blindly trusting custom inventories. --- # ⚠️⚠️⚠️ Trusted Plugin Security Warning ⚠️⚠️⚠️ Adding a plugin to `trusted-plugins` tells Anti-Dupe to accept qualifying transactions originating from that plugin as legitimate. **This creates an intentional trust boundary.** If a trusted plugin contains: - A duplication glitch - Item-generation bug - Transaction exploit - Reward exploit - Shop exploit - Crate exploit - Auction exploit - Economy exploit Anti-Dupe may treat the resulting items as legitimate because they originated from a source explicitly trusted by the administrator. For example: ```text Trusted Shop Plugin ↓ Plugin bug generates 64 items instead of 1 ↓ Anti-Dupe sees an authorized transaction ↓ Ledger may accept the increase ``` Anti-Dupe cannot reliably protect a server from a system the administrator has explicitly instructed it to trust. Only whitelist plugins that you: - Fully trust - Keep updated - Have tested carefully - Obtained from reputable sources - Actively monitor for exploit reports - Actually require to generate items Keep the trusted-plugin list **as small as possible**. Removing a plugin from `trusted-plugins` restores normal Anti-Dupe enforcement for its transactions. --- # Shop Plugin Support Anti-Dupe supports inventory-based shop systems through the Trusted Transaction Framework. Examples include: - UltimateShop - EconomyShopGUI - ShopGUIPlus - Similar inventory-based shop plugins Trusted purchases can: - Update the ledger automatically - Register newly created items - Avoid false duplicate warnings - Avoid unnecessary recovery entries - Avoid unnecessary Discord alerts - Continue protecting the player's remaining inventory --- # Immediate Event Verification Anti-Dupe verifies inventory transactions after Minecraft finishes processing them. Protected events include: - Inventory Click - Shift Click - Number Key Swap - Drag Distribution - Stack Split - Stack Merge - Double Click Collect - Offhand Swap - Hopper Transfer - Item Pickup - Item Drop - Crafting - Smithing - Anvil - Grindstone - Villager Trading - Player Login - Player Logout - Container Open - Container Close Cursor items are included in transaction snapshots to prevent normal item movement from appearing to create additional items. --- # Crafting & Workstation Protection Anti-Dupe 3.3 includes improved handling for crafting and workstation inventories. This was introduced to prevent legitimate ingredient consumption and result creation from appearing as unauthorized inventory changes. Supported transaction handling includes: - Crafting Tables - Player Crafting - Furnaces - Blast Furnaces - Smokers - Smithing Tables - Anvils - Grindstones - Brewing Stands - Crafters - Villager Trading Anti-Dupe waits for Minecraft to complete the transaction before evaluating the resulting inventory state. This prevents situations where: ```text Input exists ↓ Craft executes ↓ Output appears ↓ Input disappears ``` from temporarily being interpreted as: ```text Input exists + Output exists = Unexpected item increase ``` --- # Bundle Transaction Protection Anti-Dupe 3.3 includes special handling for Minecraft bundles. Items stored inside a vanilla bundle are considered part of the player's total ownership. Example: ```text Inventory: 32 Arrows Bundle: 32 Arrows Total ownership: 64 Arrows ``` Moving items between: ```text Bundle ↕ Cursor ↕ Player Inventory ``` does **not** represent item creation. Example configuration: ```yaml transaction-handlers: bundles: enabled: true delay-ticks: 2 include-contained-items-in-accounting: true recursive-content-check: true ``` Removing arrows from a bundle therefore does not create a false positive simply because the same items temporarily appear on the cursor or elsewhere in the inventory transaction. A genuine exploit that increases: ```text bundle + cursor + inventory ``` is still subject to normal Anti-Dupe enforcement. --- # Scanner Configuration ```yaml scanner: enabled: true online-inventory-minutes: 5 ender-chest-minutes: 10 loaded-containers-minutes: 15 uuid-crosscheck-minutes: 15 ledger-audit-minutes: 30 players-per-batch: 10 automatic-chunk-scans: true chunk-scan-delay-ticks: 20 ``` Scanner tasks are staggered to minimize server impact. --- # Scan Frequency | Scan | Default | |------|--------:| | Online Player Inventories | Every 5 minutes | | Ender Chests | Every 10 minutes | | Loaded Containers | Every 15 minutes | | Cross Inventory UUID Check | Every 15 minutes | | Ledger Audit | Every 30 minutes | Player scans are processed in configurable batches. --- # Cross-Inventory Protection Anti-Dupe compares UUID-tracked items across inventories to detect cases where the same unique item appears in multiple locations. Potential locations include: - Player inventories - Ender Chests - Chests - Barrels - Shulker Boxes - Hoppers - Furnaces - Other loaded containers - Inventory-holding entities - Chest Minecarts - Hopper Minecarts A cross-inventory detection is treated separately from normal quantity accounting. --- # High-Speed Movement Stabilization Anti-Dupe 3.3 adds additional protection against false cross-inventory detections caused by extremely rapid player movement. This is particularly important for: - Elytra flight - Nether travel - Rapid chunk transitions - Teleportation - Portal travel - World changes - Server joins - Network/server transitions At high speeds, Minecraft may rapidly load and unload chunks while Anti-Dupe is inspecting inventories. Without stabilization, a situation such as: ```text Old container observation + Player inventory ↓ Same UUID temporarily appears twice ``` could potentially look like a duplicate even though one observation is stale. Anti-Dupe therefore introduces a stabilization period before cross-inventory enforcement. Example: ```yaml cross-inventory-protection: stabilization: enabled: true after-join-ticks: 60 after-chunk-change-ticks: 10 after-world-change-ticks: 40 after-teleport-ticks: 20 after-portal-ticks: 40 high-speed: enabled: true blocks-per-second-threshold: 25.0 stabilization-ticks: 10 ``` High-speed movement does **not** exempt a player from Anti-Dupe. It only delays cross-inventory enforcement until the player's inventory and surrounding chunk state have stabilized. --- # Cross-Inventory Confirmation Cross-inventory detections can require confirmation before quarantine. Example: ```yaml cross-inventory-protection: confirmation: enabled: true delay-ticks: 3 required-matches: 2 candidate-expiry-seconds: 30 ``` Instead of: ```text Duplicate UUID observed ↓ Immediate quarantine ``` Anti-Dupe can perform: ```text Duplicate UUID observed ↓ Record candidate ↓ Wait ↓ Fresh inventory scan ↓ Duplicate still exists? / \ No Yes ↓ ↓ Discard Confirm ↓ Quarantine ``` This protects against transient inventory states without allowing genuine duplicate UUIDs to escape detection. --- # Stale Container Protection Delayed chunk scans verify that the target chunk is still loaded before scanning it. A container observation from an unloaded or invalid chunk should not be treated the same as a currently accessible live inventory. This is particularly useful when players travel rapidly through the Nether using Elytra, where large numbers of chunks can load and unload in a short period. Cross-inventory detections are designed to favor fresh, identifiable inventory evidence over stale observations. --- # Deep Scan Commands Scan everything: ```text /antidupe scan all ``` Scans: - Online players - Ender Chests - Loaded containers - Inventory-holding entities - Chest Minecarts - Hopper Minecarts - UUID registry - Stack fingerprints - Ledger totals Player inventories: ```text /antidupe scan players ``` Ender Chests: ```text /antidupe scan ender ``` Loaded containers: ```text /antidupe scan containers ``` Current chunk: ```text /antidupe scan chunk ``` --- # Automatic Chunk Scanning Whenever a chunk loads: 1. Anti-Dupe waits for the configured delay. 2. The chunk's inventory holders are inspected. 3. The chunk must still be loaded when the delayed scan executes. Default: ```yaml automatic-chunk-scans: true chunk-scan-delay-ticks: 20 ``` Supported block inventories include: - Chest - Trapped Chest - Barrel - Shulker Box - Hopper - Furnace - Blast Furnace - Smoker - Crafter - Brewing Stand - Dropper - Dispenser Supported entities include: - Chest Minecart - Hopper Minecart - Inventory-holding entities --- # Transaction Ledger Unlike traditional anti-dupe plugins, Anti-Dupe maintains an authoritative transaction ledger. Every legitimate item creation can update the ledger. Examples include: - Mining - Crafting - Smelting - Trading - Trusted shop purchases - Approved plugin transactions Unauthorized increases continue through duplicate detection. The ledger does not intentionally "learn" duplicated quantities simply because they appeared in an inventory. --- # Stack-Safe Accounting Stackable items retain normal Minecraft stacking behavior. Rather than requiring every ordinary stack to behave like a unique item, Anti-Dupe combines: - Item fingerprints - Ledger totals - Transaction accounting - Cross-inventory quantity verification This preserves vanilla stacking while detecting unauthorized quantity increases. --- # Unique Item Protection Items requiring unique tracking can receive hidden UUID information. Tracked information can include: - UUID - Player - Inventory - Slot - Timestamp - Fingerprint When the same unique UUID is confirmed in multiple independent locations: 1. Preserve the original. 2. Backup the suspected duplicate. 3. Remove the duplicate. 4. Create a recovery record. 5. Log the incident. 6. Notify administrators. 7. Send Discord notification if configured. --- # Safe Removal & Recovery Anti-Dupe uses a **backup-before-removal** policy. Before a suspected duplicate is removed, the complete ItemStack is written to: ```text plugins/Anti-Dupe/recovery.yml ``` Stored information can include: - Material - Amount - Name - Lore - Enchantments - Durability - Components - Persistent Data - Player - UUID - World - Coordinates - Detection Reason - Timestamp - Recovery ID - Restore Status If the backup fails: - The item remains untouched. - A severe error is logged. This prevents Anti-Dupe itself from permanently destroying an item that cannot first be recovered. --- # Recovery Commands Recent recovery records: ```text /antidupe recovery list ``` Records for a player: ```text /antidupe recovery player <player> ``` Restore to original owner: ```text /antidupe recovery restore <id> ``` Restore to another player: ```text /antidupe recovery restore <id> <player> ``` Permission: ```text antidupe.recovery ``` --- # Inventory Rollbacks Anti-Dupe 3.3 includes inventory rollback functionality for situations where administrators need to restore an earlier inventory state. Commands include: ```text /antidupe rollback list [player] ``` Create a snapshot: ```text /antidupe rollback snapshot ``` Restore a snapshot: ```text /antidupe rollback restore <id> [player] ``` Rollback functionality provides another recovery layer beyond individual quarantined items. --- # Administrator Whitelist Add: ```text /antidupe whitelist add <player> ``` Remove: ```text /antidupe whitelist remove <player> ``` Check: ```text /antidupe whitelist check <player> ``` List: ```text /antidupe whitelist list ``` Stored in: ```text plugins/Anti-Dupe/admin-whitelist.yml ``` Permission: ```text antidupe.whitelist ``` --- # Server Security Protection Anti-Dupe 3.3 includes optional protections against unauthorized administrative privileges. The security system can protect: - Operator status - Creative Mode access These protections use UUID-based authorization. Example: ```yaml security: enabled: false op-protection: enabled: true allowed-uuids: [] creative-protection: enabled: true allowed-uuids: [] fallback-gamemode: SURVIVAL ``` The main security system is intentionally disabled by default. Administrators should configure their UUIDs **before enabling it**. --- # Operator Protection Operator Protection prevents unauthorized players from obtaining or retaining OP status. Authorized administrators can be managed in-game. Add: ```text /antidupe opprot add <player> ``` Remove: ```text /antidupe opprot remove <player> ``` List: ```text /antidupe opprot list ``` The player's UUID is stored under: ```yaml security: op-protection: allowed-uuids: [] ``` Player names can be selected using command completion where available. UUID storage prevents simple username changes from bypassing the protection. --- # Creative Mode Protection Creative Mode can also be restricted to explicitly authorized UUIDs. Add: ```text /antidupe creativeprot add <player> ``` Remove: ```text /antidupe creativeprot remove <player> ``` List: ```text /antidupe creativeprot list ``` Stored under: ```yaml security: creative-protection: allowed-uuids: [] ``` Unauthorized Creative Mode can be reverted to the configured fallback: ```yaml fallback-gamemode: SURVIVAL ``` Permission for the security-management commands: ```text antidupe.security ``` The main `/antidupe` command also requires: ```text antidupe.admin ``` --- # ⚠️ Operator Protection Setup Warning **Configure your administrator UUIDs before enabling the main security system.** If: ```yaml security: enabled: true op-protection: enabled: true allowed-uuids: [] ``` then there are **no authorized operator UUIDs**. Anti-Dupe may therefore treat every OP player as unauthorized. The same principle applies to Creative Mode protection. Recommended setup: ```text 1. Install Anti-Dupe 2. Start the server 3. Add authorized administrators 4. Verify the UUID lists 5. Enable security 6. Restart/reload as appropriate ``` --- # Database Support Anti-Dupe uses persistent transaction storage for ledger and tracking information. SQLite provides a local database suitable for single-server installations. The database layer is designed to support migration as Anti-Dupe's schema evolves. Database migration support allows newer plugin versions to update older stored data without requiring administrators to manually rebuild the Anti-Dupe database. As with any server database, administrators should maintain regular backups. --- # Network Support Anti-Dupe 3.3 includes architecture for multi-server environments using systems such as: - Velocity - BungeeCord Network synchronization is intended to prevent an item from appearing legitimate simply because it moved between backend servers. Network-aware protection can be used to coordinate Anti-Dupe state across connected servers rather than treating every backend as an entirely independent economy. Configuration should remain optional so standalone Paper servers do not require proxy infrastructure. --- # World-Aware Rules Anti-Dupe can use world-aware protection policies so administrators can apply different rules to different environments. Examples include: - Survival worlds - Creative worlds - Event worlds - Minigame worlds - Resource worlds - Lobby worlds This is useful when a server intentionally allows behavior in one world that should never be accepted in another. Administrators should keep exemptions as narrow as possible. --- # Exploit Fingerprint Database Anti-Dupe 3.3 includes support for identifying known duplication behavior through exploit fingerprints. Rather than relying entirely on a single inventory count, exploit fingerprints can describe suspicious transaction patterns associated with known duplication techniques. Potential fingerprint information includes: - Transaction sequence - Inventory type - Item movement pattern - Timing - Quantity change - Container interaction - Repeated UUID behavior Fingerprint-based detection supplements the normal ledger, UUID, and inventory systems rather than replacing them. --- # Testing Command ```text /dupe ``` The administrator-only testing command intentionally duplicates the held item. It is designed to verify that Anti-Dupe's detection and quarantine systems are working. The test ignores: - Administrator whitelist - OP status - `antidupe.bypass` Permission: ```text antidupe.dupe ``` ⚠️ **Use `/dupe` only on a test server or in a controlled environment.** --- # Console Verbosity Anti-Dupe includes configurable console logging levels. ```yaml warnings: console: true console-verbosity: low ``` Available levels: | Level | Description | |------|-------------| | `off` | Suppresses routine Anti-Dupe console output | | `low` | Startup information and confirmed detections/removals | | `med` | Includes scheduled and manual scan summaries | | `high` | Diagnostic, testing and administrative information | Critical recovery failures can still be logged regardless of routine verbosity. Changing console verbosity does **not** disable: - Discord alerts - Recovery records - Daily logs - In-game administrator notifications This allows large servers to reduce console spam without weakening Anti-Dupe's other reporting systems. --- # Private Detection Notifications Regular players do not receive duplicate-detection warnings. Detection information is restricted to: - Server Console - Authorized Administrators - Daily Log Files - Discord Permission: ```text antidupe.notify ``` This prevents suspected exploiters from receiving detailed information about the detection system. --- # Daily Logs Location: ```text plugins/Anti-Dupe/logs/ ``` Filename: ```text anti-dupe-YYYY-MM-DD.log ``` Logs rotate automatically by date. --- # Discord Webhook Alerts Anti-Dupe supports rich Discord webhook notifications. Configuration: ```yaml discord: enabled: true webhook-url: "" username: "Anti-Dupe" avatar-url: "" locale: en_US embed-color: "#FFB000" include-coordinates: true role-mention: "" ``` Detection embeds can contain: - Player - UUID - World - Coordinates - Detection Time - Detection Reason - Removed Item - Removed Quantity - Recovery ID - Removal confirmation Webhook delivery runs asynchronously to avoid blocking the main Minecraft server thread. Discord may use a separate locale from the server's default language. --- # Console vs Discord Logging Console verbosity only controls console output. For example: ```yaml warnings: console-verbosity: off ``` does **not** disable: ```text Discord alerts Recovery records Daily logs Administrator notifications ``` This separation allows administrators to keep detailed security records while maintaining a clean server console. --- # Multi-Language Support Anti-Dupe now provides **28 locale variants**. Supported locales: | Locale | Language | |--------|----------| | 🇺🇸 `en_US` | English | | 🇩🇪 `de_DE` | German | | 🇪🇸 `es_ES` | Spanish | | 🇨🇦 `fr_CA` | French (Canada) | | 🇫🇷 `fr_FR` | French (France) | | 🇮🇹 `it_IT` | Italian | | 🇯🇵 `ja_JP` | Japanese | | 🇵🇱 `pl_PL` | Polish | | 🇧🇷 `pt_BR` | Portuguese (Brazil) | | 🇷🇺 `ru_RU` | Russian | | 🇹🇷 `tr_TR` | Turkish | | 🇺🇦 `uk_UA` | Ukrainian | | 🇨🇳 `zh_CN` | Simplified Chinese | | 🇰🇷 `ko_KR` | Korean | | 🇳🇱 `nl_NL` | Dutch | | 🇨🇿 `cs_CZ` | Czech | | 🇮🇩 `id_ID` | Indonesian | | 🇹🇼 `zh_TW` | Traditional Chinese (Taiwan) | | 🇸🇪 `sv_SE` | Swedish | | 🇳🇴 `no_NO` | Norwegian | | 🇩🇰 `da_DK` | Danish | | 🇫🇮 `fi_FI` | Finnish | | 🇷🇴 `ro_RO` | Romanian | | 🇭🇺 `hu_HU` | Hungarian | | 🇬🇷 `el_GR` | Greek | | 🇸🇦 `ar_SA` | Arabic | | 🇮🇱 `he_IL` | Hebrew (Israel) | | 🇮🇳 `hi_IN` | Hindi (India) | Configuration: ```yaml language: default: en_US use-client-locale: true ``` Language files: ```text plugins/Anti-Dupe/lang/ ``` When client-locale support is enabled, Anti-Dupe can use the player's supported locale where appropriate. Unsupported client locales can fall back to the configured default language. --- # New Languages Added Anti-Dupe's international support has been substantially expanded. The following locales were added: - 🇰🇷 `ko_KR` — Korean - 🇳🇱 `nl_NL` — Dutch - 🇨🇿 `cs_CZ` — Czech - 🇮🇩 `id_ID` — Indonesian - 🇹🇼 `zh_TW` — Traditional Chinese (Taiwan) - 🇸🇪 `sv_SE` — Swedish - 🇳🇴 `no_NO` — Norwegian - 🇩🇰 `da_DK` — Danish - 🇫🇮 `fi_FI` — Finnish - 🇷🇴 `ro_RO` — Romanian - 🇭🇺 `hu_HU` — Hungarian - 🇬🇷 `el_GR` — Greek - 🇸🇦 `ar_SA` — Arabic - 🇮🇱 `he_IL` — Hebrew (Israel) - 🇮🇳 `hi_IN` — Hindi (India) This expands Anti-Dupe well beyond its original language set and makes administration easier for international server communities. --- # Administrator README Anti-Dupe includes administrator documentation with the plugin resources. The README provides local reference information for: - Security configuration - OP protection - Creative protection - Trusted plugins - Recovery - Inventory rollback - Deep scanning - Console verbosity - Testing - Bundle handling Localized README files can also be provided alongside supported language resources. --- # bStats Metrics Anti-Dupe includes support for **bStats** anonymous plugin metrics. Metrics are intended to provide general usage information useful for understanding Anti-Dupe adoption and compatibility. Metrics should never be used as part of duplicate enforcement. Server administrators can control bStats through the normal bStats configuration system. --- # Permissions ```text antidupe.admin antidupe.notify antidupe.whitelist antidupe.recovery antidupe.dupe antidupe.bypass antidupe.security ``` Individual installations may expose additional permissions for specific administrative functionality. --- # Recommended Deployment For a new installation, begin in: ```yaml mode: AUDIT ``` Before enabling automatic quarantine, test normal server activity extensively. Test: - Crafting - Player crafting - Furnaces - Blast Furnaces - Smokers - Smithing - Anvils - Grindstones - Brewing - Villager Trading - Shops - Trusted plugins - Hoppers - Ender Chests - Chests - Barrels - Shulker Boxes - Bundles - Stack Splitting - Stack Merging - Item Pickup - Item Drop - Elytra flight - High-speed Nether travel - Portals - Teleports - Chunk loading - Modded/custom containers - Proxy/server transfers where applicable Administrators should also test: ```text /dupe ``` to verify intentional duplicate detection. After normal gameplay has been validated: ```yaml mode: QUARANTINE ``` --- # Quarantine Workflow When Anti-Dupe confirms an unauthorized duplicate: ```text Suspicious item detected ↓ Verify transaction ↓ Confirm duplicate ↓ Preserve original ↓ Backup duplicate ↓ Create recovery record ↓ Remove duplicate ↓ Update logs ↓ Notify administrators ↓ Send Discord alert ``` The administrator can then review the incident and restore the item if the detection was a false positive. --- # False Positive Protection Philosophy Anti-Dupe is designed around the principle that: > **Detection confidence is more important than immediately deleting a suspicious item.** Where possible, Anti-Dupe attempts to distinguish: ```text Item movement ``` from: ```text Item creation ``` and: ```text Temporary inventory state ``` from: ```text Persistent duplicate state ``` Systems such as: - Transaction grace periods - Trusted transactions - Cursor accounting - Crafting transaction handling - Bundle accounting - Movement stabilization - Cross-inventory confirmation - Recovery backups - Inventory rollbacks exist specifically to reduce the risk of legitimate items being permanently lost. 

# Anti-Dupe 3.3 ## Overview Anti-Dupe 3.3 is an advanced anti-duplication, inventory-integrity, transaction-monitoring, and server-security system for Paper Minecraft servers. Rather than relying solely on inventory scanning, Anti-Dupe combines: - Transaction accounting - Event verification - Cross-inventory auditing - UUID tracking - Trusted-plugin verification - Vanilla transaction validation - Bundle-aware accounting - Exploit fingerprinting - Recovery systems - Inventory rollback protection - Cross-server synchronization - Configurable administrative security controls Anti-Dupe is designed to preserve normal Minecraft mechanics while protecting server economies from duplication exploits, plugin bugs, inventory desynchronization, rollback exploits, custom storage exploits, unsafe item transfers, and unexpected item-generation paths. --- # Core Features - Immediate event-based verification - Hybrid inventory scanning - Transaction Ledger - Trusted Plugin Verification - Shop Plugin Compatibility - Vanilla Transaction Engine - Dedicated workstation transaction handlers - Bundle transaction protection - Recursive bundle-content accounting - Custom command transfer protection - Plugin-managed vault protection - Repeated small-transfer detection - Stack-safe accounting - UUID tracking for unique items - Stacked unique-item integrity protection - Cross-inventory duplicate detection - Automatic chunk scanning - Deep inventory auditing - Inventory rollback system - Safe removal & recovery - Exploit Fingerprint Database - World-aware protection rules - SQLite database support - MySQL database support - MariaDB database support - PostgreSQL database support - Automatic database migrations - Velocity/Bungee network support - Cross-server item tracking - Player transfer protection - OP whitelist protection - Creative-mode whitelist protection - In-game OP protection management - In-game Creative protection management - Automatic UUID resolution - Daily rotating log files - Discord webhook alerts - Multi-language support - Automatic language-file migration - Automatic malformed-language-file recovery - Console verbosity controls - Administrator whitelist - Original item preservation - Bundled administrator README - bStats metrics support --- # Trusted Plugin Framework Anti-Dupe maintains the trusted-plugin framework introduced during the 3.2 development cycle. Anti-Dupe does **not** trust every custom inventory. A custom inventory transaction is considered trusted only when BOTH conditions are met: 1. The inventory title matches an approved pattern. 2. The inventory originates from an explicitly trusted plugin. Example: ```yaml compatibility: external-plugin-inventories: enabled: true grace-delay-ticks: 4 trusted-plugins: - UltimateShop title-patterns: - shop - store - market ``` Additional compatible plugins may be added: ```yaml trusted-plugins: - UltimateShop - EconomyShopGUI - ShopGUIPlus ``` Matching is case-insensitive. This prevents Anti-Dupe from blindly trusting an inventory simply because its title contains words such as `shop`. --- # Shop Plugin Support Anti-Dupe supports trusted inventory-based shop systems while continuing to protect normal player inventories. Trusted purchases can: - Update the Anti-Dupe ledger - Register legitimately created items - Avoid duplicate false positives - Avoid unnecessary recovery records - Avoid unnecessary Discord alerts - Continue protecting the player's other inventory activity > ## ⚠️⚠️⚠️ Trusted Plugin Security Risk ⚠️⚠️⚠️ > > Adding a plugin to `trusted-plugins` tells Anti-Dupe to accept qualifying item transactions from that plugin as legitimate. > > This means Anti-Dupe may be unable to detect duplication glitches, item-generation bugs, or exploitable transaction errors originating inside that trusted plugin. > > If a trusted shop, crate, auction, reward, or economy plugin contains a bug that allows players to receive extra items, Anti-Dupe may treat those items as authorized. > > Only whitelist plugins that you: > > - Fully trust > - Keep updated > - Have tested carefully > - Obtained from a reputable source > - Actively monitor for exploit reports > > Keep the trusted-plugin list as small as possible. > > Removing a plugin from `trusted-plugins` restores normal Anti-Dupe enforcement for its inventory transactions. --- # Vanilla Transaction Engine Anti-Dupe 3.3 includes dedicated handling for Minecraft's vanilla item-transformation systems. Instead of treating every workstation operation as a generic inventory change, Anti-Dupe identifies the type of transaction being performed and verifies it according to the behavior of that workstation. Supported transaction handlers include: - Player 2×2 Crafting - Crafting Table - Anvil - Grindstone - Smithing Table - Stonecutter - Cartography Table - Loom - Villager Trading - Furnace - Blast Furnace - Smoker - Brewing Stand - Crafter - Bundles This greatly reduces false positives caused by virtual result slots, delayed inventory processing, nested inventories, and legitimate item transformations. --- # Crafting Protection Crafting is handled separately from generic inventory clicks. Anti-Dupe allows Minecraft to complete the transaction before validating the result. Example: ```text 1 Oak Log ↓ Minecraft Recipe ↓ 4 Oak Planks ``` Anti-Dupe recognizes the consumed ingredient and authorized recipe output instead of treating the four planks as unexplained item creation. Virtual crafting-result previews are excluded from owned-item totals until the player actually completes the craft. This protects: - Player 2×2 crafting - Crafting Tables - Normal clicks - Shift-click crafting - Repeated crafting operations --- # Workstation Protection Different Minecraft workstations behave differently. Anti-Dupe accounts for those differences when monitoring: ```text Crafting Smithing Anvils Grindstones Stonecutters Cartography Looms Villager Trading Smelting Brewing Automated Crafting Bundles ``` For example, an anvil result is a virtual preview until collected, while an item already sitting in a furnace output slot is a real stored item. Anti-Dupe distinguishes these cases instead of applying a single generic inventory formula to every workstation. --- # Transaction Handler Configuration Individual vanilla transaction handlers can be enabled or disabled. ```yaml transaction-handlers: crafting: enabled: true delay-ticks: 2 anvil: enabled: true delay-ticks: 2 grindstone: enabled: true delay-ticks: 2 smithing: enabled: true delay-ticks: 2 stonecutter: enabled: true delay-ticks: 2 cartography: enabled: true delay-ticks: 2 loom: enabled: true delay-ticks: 2 villager-trades: enabled: true delay-ticks: 2 furnace: enabled: true blast-furnace: enabled: true smoker: enabled: true brewing: enabled: true crafter: enabled: true bundles: enabled: true delay-ticks: 2 include-contained-items-in-accounting: true recursive-content-check: true ``` This allows individual systems to be disabled if a plugin or datapack significantly modifies vanilla behavior. --- # Bundle Transaction Protection Anti-Dupe 3.3 includes dedicated protection for Minecraft bundles. Items contained inside a bundle are included in conservation accounting rather than being treated as invisible storage. This prevents actions such as removing arrows from a bundle from incorrectly appearing as new item creation. Example: ```text BEFORE Bundle: Arrow x4 Player/Cursor: Arrow x0 TOTAL: Arrow x4 ``` After taking the arrows out: ```text AFTER Bundle: Arrow x0 Player/Cursor: Arrow x4 TOTAL: Arrow x4 ``` Result: ```text NET CHANGE: 0 STATUS: VALID ``` Anti-Dupe does **not** simply whitelist bundle interactions. If an exploit causes: ```text Before Total: 4 After Total: 8 ``` Anti-Dupe can still identify: ```text Unexplained Excess: 4 ``` and send the excess through the normal recovery and quarantine pipeline. Bundle protection can account for: - Taking items from bundles - Putting items into bundles - Cursor-held bundle operations - Inventory-held bundles - Nested bundle contents - Recursive contained-item accounting --- # Recursive Nested-Item Accounting When enabled: ```yaml transaction-handlers: bundles: include-contained-items-in-accounting: true recursive-content-check: true ``` Anti-Dupe counts the contents of nested item containers when calculating transaction totals. This is particularly important because moving an item: ```text Player Inventory ↓ Bundle ``` should not appear as item destruction. Likewise: ```text Bundle ↓ Player Inventory ``` should not appear as item creation. The total quantity remains authoritative. --- # Custom Command Transfer Protection Anti-Dupe 3.3 can monitor item-transfer commands such as `/gift`. This helps protect against exploits where a custom plugin moves or creates an item without passing through normal Minecraft inventory mechanics. Example configuration: ```yaml advanced-transfer-protection: command-transfers: enabled: true grace-delay-ticks: 4 include-ender-chests: true include-open-inventories: true capture-rollbacks-for-online-players: true monitor-all-plugin-commands: false monitored-labels: - gift - senditem - itemgift ``` Anti-Dupe compares quantities before and after the transaction. A legitimate transfer: ```text Sender: -64 Recipient: +64 ---------------- Net: 0 ``` A suspicious transfer: ```text Sender: 0 Recipient: +64 ---------------- Net: +64 ``` The unexplained quantity can enter the normal Anti-Dupe detection, recovery, and quarantine pipeline. Trusted shop plugins are not automatically trusted for arbitrary commands. --- # Plugin-Managed Vault Protection Custom private storage systems can create blind spots for traditional anti-dupe systems. Anti-Dupe 3.3 includes configurable monitoring for plugin-managed vaults and private storage. ```yaml plugin-managed-storage: enabled: true title-patterns: - vault - private vault - storage - player vault plugins: [] verify-open-close-conservation: true crosscheck-on-open: true state-save-delay-ticks: 3 closed-state-increase-action: audit ``` Anti-Dupe can: - Track player and vault quantities - Cross-check UUIDs when storage opens - Save observed storage fingerprints - Compare previous and current vault states - Record vault open/close activity - Detect unexplained storage increases Available closed-state actions: ```text ignore audit quarantine ``` `audit` is recommended when a storage plugin can legitimately modify vault contents while the vault is closed. --- # Repeated Small-Transfer Detection Some duplication techniques attempt to avoid detection thresholds by moving duplicated items in many small transactions. Anti-Dupe can aggregate suspicious activity over a rolling window. ```yaml repeated-small-transfers: enabled: true window-seconds: 30 maximum-single-delta: 16 event-threshold: 3 quantity-threshold: 8 ``` This allows Anti-Dupe to recognize a suspicious pattern even when no single transaction is large enough to trigger a normal threshold. --- # Identity Integrity Protection Items that Anti-Dupe considers unique are protected against stacked identity bypasses. If multiple supposedly unique items appear inside one stack, Anti-Dupe can: 1. Preserve the legitimate item. 2. Back up the unexplained excess. 3. Remove the excess. 4. Create a recovery entry. 5. Continue UUID tracking. Normally stackable materials can optionally be forced into unique-item semantics: ```yaml identity-integrity: enabled: true force-unique-materials: [] ``` Use `force-unique-materials` carefully because forcing a normally stackable material into unique semantics intentionally changes how Anti-Dupe treats that item. --- # Scanner Configuration ```yaml scanner: enabled: true online-inventory-minutes: 5 ender-chest-minutes: 10 loaded-containers-minutes: 15 uuid-crosscheck-minutes: 15 ledger-audit-minutes: 30 players-per-batch: 10 automatic-chunk-scans: true chunk-scan-delay-ticks: 20 ``` Scanner tasks are staggered to minimize server impact. --- # Scan Frequency | Scan | Default | |------|--------:| | Online Player Inventories | Every 5 minutes | | Ender Chests | Every 10 minutes | | Loaded Containers | Every 15 minutes | | Cross Inventory UUID Check | Every 15 minutes | | Ledger Audit | Every 30 minutes | --- # Immediate Event Verification Anti-Dupe monitors inventory activity around Minecraft transactions. Protected activity includes: - Inventory Click - Shift Click - Number Key Swap - Drag Distribution - Stack Split - Stack Merge - Double Click Collect - Offhand Swap - Hopper Transfer - Item Pickup - Item Drop - Bundle Pickup - Bundle Placement - Crafting - Smithing - Anvil - Grindstone - Stonecutting - Cartography - Loom Operations - Villager Trading - Smelting - Brewing - Crafter Operations - Player Login - Player Logout - Container Open - Container Close Cursor items and nested bundle contents are included where appropriate to prevent legitimate inventory movement from appearing as duplication. --- # Deep Scan Commands Scan everything: ```text /antidupe scan all ``` Player inventories: ```text /antidupe scan players ``` Ender Chests: ```text /antidupe scan ender ``` Loaded containers: ```text /antidupe scan containers ``` Current chunk: ```text /antidupe scan chunk ``` The full scan can check: - Online players - Ender Chests - Loaded containers - Inventory entities - Chest Minecarts - Hopper Minecarts - UUID registry - Ledger totals - Stack fingerprints --- # Automatic Chunk Scanning Whenever a chunk loads: 1. Anti-Dupe waits for the configured delay. 2. Supported inventory holders are scanned. Supported block inventories include: - Chest - Trapped Chest - Barrel - Shulker Box - Hopper - Furnace - Blast Furnace - Smoker - Brewing Stand - Crafter - Dropper - Dispenser Supported entities include: - Chest Minecart - Hopper Minecart - Inventory-holding entities --- # Transaction Ledger Anti-Dupe maintains a transaction ledger for legitimate item creation and movement. Examples include: - Mining - Crafting - Smelting - Trading - Trusted shop purchases - Authorized workstation transformations - Bundle transfers - Legitimate inventory movement Unauthorized increases continue through duplicate detection. The ledger does not automatically accept an unexplained quantity increase simply because the item exists. --- # Stack-Safe Accounting Stackable items retain normal vanilla behavior. Anti-Dupe uses: - Item fingerprints - Ledger totals - Transaction accounting - Cross-inventory quantity verification - Nested-container accounting where supported This allows ordinary stacks to split, merge, consolidate, enter bundles, and leave bundles without requiring every stack to contain a different UUID. --- # Unique Item Protection Items treated as unique can receive hidden UUID tracking. Tracked information can include: - UUID - Player - Inventory - Slot - Timestamp - Fingerprint When a duplicate UUID is confirmed: 1. Preserve the original. 2. Back up the duplicate. 3. Remove the duplicate. 4. Create a recovery entry. 5. Notify administrators. --- # Inventory Rollbacks Anti-Dupe 3.3 includes inventory rollback support. Snapshots can preserve player inventory state before sensitive operations or suspicious transactions. Snapshot information can include: - Main inventory - Hotbar - Armor - Offhand - Ender Chest - Player UUID - Server - World - Timestamp - Snapshot reason Rollback commands can include: ```text /antidupe rollback list [player] ``` ```text /antidupe rollback snapshot ``` ```text /antidupe rollback restore <id> [player] ``` Permission: ```text antidupe.rollback ``` --- # Safe Removal & Recovery Before an item is removed by Anti-Dupe, its complete ItemStack is backed up to: ```text plugins/Anti-Dupe/recovery.yml ``` Stored information can include: - Material - Amount - Name - Lore - Enchantments - Durability - Components - Persistent Data - Player - UUID - World - Coordinates - Detection Reason - Timestamp - Recovery ID - Restore Status If the recovery backup fails: - The item is NOT removed. - A severe error is logged. --- # Recovery Commands Recent recovery entries: ```text /antidupe recovery list ``` Lookup player: ```text /antidupe recovery player <player> ``` Restore original owner: ```text /antidupe recovery restore <id> ``` Restore to another player: ```text /antidupe recovery restore <id> <player> ``` Permission: ```text antidupe.recovery ``` --- # Database Support Anti-Dupe 3.3 supports: - SQLite - MySQL - MariaDB - PostgreSQL Database functionality can support: - Transaction ledger records - Network synchronization - Inventory state information - Virtual storage observations - Exploit information - Cross-server coordination - Storage fingerprints - Transfer state Example: ```yaml database: type: sqlite schema-migrations: true fail-startup-on-error: true sqlite: file: anti-dupe.db remote: host: 127.0.0.1 port: 3306 database: antidupe username: antidupe password: change-me ``` --- # Automatic Database Migration Anti-Dupe can automatically migrate its database schema as new data structures are introduced. This reduces the need for administrators to manually recreate databases during upgrades. Backups are still recommended before major database or plugin upgrades. --- # Velocity & Bungee Network Support Anti-Dupe 3.3 includes support for multi-server environments using Velocity or BungeeCord-style proxy networks. Network protection can coordinate: - Backend server IDs - Server heartbeats - Player transfer state - Transfer locks - Transfer snapshots - Shared ledger information - Cross-server UUID checks - Cross-server item accounting Example: ```yaml network: enabled: false proxy: VELOCITY server-id: survival-1 heartbeat-seconds: 30 stale-server-seconds: 120 transfer-lock-seconds: 20 join-verification-delay-ticks: 20 capture-transfer-snapshot: true shared-ledger: true cross-server-uuid-checks: true cross-server-stack-accounting: true ``` Every backend server should have a unique `server-id`. --- # Player Transfer Protection Cross-server movement can create an inventory synchronization window. Anti-Dupe can use: - Transfer snapshots - Transfer locks - Join verification - Shared ledger information - Cross-server UUID checks to help prevent items from existing simultaneously on multiple backend servers. --- # World-Aware Rules Different worlds can use different Anti-Dupe enforcement policies. Available policies include: ```text inherit disabled audit quarantine ``` Example: ```yaml world-rules: enabled: true default-mode: inherit worlds: world: mode: quarantine creative: mode: audit build_world: mode: disabled ``` This allows survival, creative, event, build, and administrative worlds to use different enforcement behavior. --- # Exploit Fingerprint Database Anti-Dupe 3.3 can classify suspicious behavior against known exploit patterns. Fingerprint categories can include: - Inventory rollback / stale-state replay - Hopper race conditions - Chunk unload/load duplication - Exact UUID cloning - Plugin transaction replay - Custom command transfer / identity-registration bypass - Plugin-managed vault quantity bypass - Repeated small-transfer threshold evasion - Stacked unique-item identity bypass Fingerprint results may include an estimated confidence level. These classifications are investigative indicators and are not absolute proof of which exploit was used. --- # OP Security Protection Anti-Dupe includes an optional strict OP authorization system. Only UUIDs explicitly listed in the security configuration may retain operator status. ```yaml security: enabled: false enforce-on-startup: true enforce-on-join: true enforce-on-world-change: true audit-period-seconds: 1 delayed-join-rechecks-ticks: - 1 - 20 - 100 notify-admins: true notify-permission: antidupe.notify op-protection: enabled: true allowed-uuids: [] block-player-op-commands: true recheck-after-server-commands: true ``` Protection includes: - Startup OP audit - Login OP verification - Delayed login rechecks - Periodic OP reconciliation - Player `/op` interception - `/minecraft:op` interception - `/bukkit:op` interception - Server-command rechecks - Removal of unauthorized OP status The periodic audit acts as a final reconciliation layer if another plugin grants OP directly. --- # In-Game OP Protection Management Authorized administrators can manage the OP protection UUID list without editing `config.yml`. Add a player: ```text /antidupe opprot add <player> ``` Remove a player: ```text /antidupe opprot remove <player> ``` List protected players: ```text /antidupe opprot list ``` When a player is added: 1. Anti-Dupe resolves the selected player's UUID. 2. The UUID is added to: ```yaml security: op-protection: allowed-uuids: - 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' ``` 3. The updated list is saved to `config.yml`. Tab completion displays online players for `add`. For removal, Anti-Dupe can suggest known players already present in the protection list. --- # Creative Mode Protection Creative mode can optionally be restricted to explicitly authorized UUIDs. ```yaml security: creative-protection: enabled: true allowed-uuids: [] fallback-gamemode: SURVIVAL ``` Protection includes: - Blocking unauthorized Creative-mode changes - Login verification - Delayed login rechecks - World-change verification - Periodic reconciliation If an unauthorized player is found in Creative mode, Anti-Dupe can move them back to the configured fallback game mode. --- # In-Game Creative Protection Management Authorized administrators can manage the Creative protection list in game. Add: ```text /antidupe creativeprot add <player> ``` Remove: ```text /antidupe creativeprot remove <player> ``` List: ```text /antidupe creativeprot list ``` When added, the player's UUID is stored under: ```yaml security: creative-protection: allowed-uuids: - 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' ``` The list is persisted directly to `config.yml`. --- # Security Management Permission Managing OP and Creative protection requires: ```text antidupe.security ``` This permission defaults to OP. Access to the main Anti-Dupe administrative command is also required. --- # ⚠️ Security Guard Setup Warning The master security system should remain disabled until legitimate administrator UUIDs are configured. ```yaml security: enabled: false ``` Before enabling: ```yaml security: enabled: true ``` make sure every legitimate administrator who requires OP or Creative access has been added to the appropriate UUID list. An enabled OP guard with an empty whitelist means: ```text NO PLAYER IS AUTHORIZED TO REMAIN OP ``` The OP/Creative security lists are separate from Anti-Dupe's normal duplication bypass whitelist. --- # Administrator Whitelist Anti-Dupe's normal administrator whitelist remains separate from OP and Creative protection. Add: ```text /antidupe whitelist add <player> ``` Remove: ```text /antidupe whitelist remove <player> ``` Check: ```text /antidupe whitelist check <player> ``` List: ```text /antidupe whitelist list ``` Stored in: ```text plugins/Anti-Dupe/admin-whitelist.yml ``` Permission: ```text antidupe.whitelist ``` --- # Administrator Test Command ```text /dupe ``` Duplicates the held item specifically for Anti-Dupe testing. The test is designed to exercise duplicate detection even when used by an administrator. Permission: ```text antidupe.dupe ``` --- # Console Verbosity Anti-Dupe includes configurable console logging levels. ```yaml warnings: console: true console-verbosity: low ``` Levels: | Level | Description | |------|-------------| | `off` | Suppress routine Anti-Dupe console output | | `low` | Startup and confirmed detections | | `med` | Scan summaries | | `high` | Diagnostics and testing information | Critical data-safety and recovery failures remain logged. Discord alerts, recovery records, daily logs, and administrator notifications are independent of console verbosity. --- # Private Detection Notifications Ordinary players do not receive duplicate-detection alerts. Notifications can be sent to: - Server Console - Authorized Administrators - Daily Log Files - Discord Permission: ```text antidupe.notify ``` --- # Daily Logs Location: ```text plugins/Anti-Dupe/logs/ ``` Format: ```text anti-dupe-YYYY-MM-DD.log ``` A new log is automatically used each day. --- # Discord Webhook Alerts Anti-Dupe supports asynchronous Discord webhook notifications. Detection embeds can contain: - Player - UUID - World - Coordinates - Detection Time - Detection Reason - Removed Item - Removed Quantity - Recovery ID Example: ```yaml discord: enabled: true webhook-url: "" username: "Anti-Dupe" avatar-url: "" locale: en_US embed-color: "#FFB000" include-coordinates: true role-mention: "" ``` Discord delivery runs asynchronously so webhook latency does not block the Minecraft server thread. --- # Multi-Language Support Supported locales: - de_DE - en_US - es_ES - fr_CA - fr_FR - it_IT - ja_JP - pl_PL - pt_BR - ru_RU - tr_TR - uk_UA - zh_CN Configuration: ```yaml language: default: en_US use-client-locale: true ``` Language files are stored in: ```text plugins/Anti-Dupe/lang/ ``` --- # Language File Migration Anti-Dupe can add newly introduced translation keys to existing language files without intentionally overwriting existing administrator customizations. The language files include a schema marker such as: ```yaml language-version: '3.3.1' ``` The language schema version is separate from the Anti-Dupe plugin version. --- # Language YAML Safety & Automatic Repair Anti-Dupe 3.3 includes additional protection against malformed language files. All bundled locale files use valid YAML structure. If an installed locale file becomes malformed, Anti-Dupe can: 1. Detect the YAML parsing failure. 2. Preserve the broken file as a backup. 3. Restore the bundled valid language file. 4. Continue loading the plugin. Example backup: ```text plugins/Anti-Dupe/lang/zh_CN.broken-20260808-121700.yml ``` This prevents a malformed translation from producing repeated startup parser errors or stopping the language system from loading correctly. --- # Bundled Administrator README Anti-Dupe includes administrator documentation inside the plugin resources: ```text src/main/resources/README.md ``` On first run, the README is copied to: ```text plugins/Anti-Dupe/README.md ``` This gives server administrators access to setup and command documentation without needing to open the source project or plugin JAR. The README includes information covering: - Installation - Anti-Dupe modes - Scanning - Recovery - Rollbacks - Trusted plugins - Security warning - OP protection - Creative protection - Security whitelist commands - Console verbosity - Database support - Network support - Discord - Permissions --- # bStats Metrics Anti-Dupe includes optional bStats integration. bStats Plugin ID: ```text 25245 ``` The bStats library remains separate from the Anti-Dupe version. Example dependency: ```gradle implementation 'org.bstats:bstats-bukkit:3.2.1' ``` Anti-Dupe itself remains: ```text 3.3 ``` Metrics can be controlled in configuration. Privacy-sensitive information such as player names, UUIDs, webhook URLs, inventory contents, recovery data, coordinates, and administrator whitelist entries should not be reported through metrics. --- # Permissions ```text antidupe.admin antidupe.notify antidupe.whitelist antidupe.recovery antidupe.rollback antidupe.security antidupe.dupe antidupe.bypass ``` --- # Main Administrative Commands ```text /antidupe ``` Scanning: ```text /antidupe scan all /antidupe scan players /antidupe scan ender /antidupe scan containers /antidupe scan chunk ``` Recovery: ```text /antidupe recovery list /antidupe recovery player <player> /antidupe recovery restore <id> /antidupe recovery restore <id> <player> ``` Rollback: ```text /antidupe rollback list [player] /antidupe rollback snapshot /antidupe rollback restore <id> [player] ``` Administrator whitelist: ```text /antidupe whitelist add <player> /antidupe whitelist remove <player> /antidupe whitelist check <player> /antidupe whitelist list ``` OP protection: ```text /antidupe opprot add <player> /antidupe opprot remove <player> /antidupe opprot list ``` Creative protection: ```text /antidupe creativeprot add <player> /antidupe creativeprot remove <player> /antidupe creativeprot list ``` Console verbosity: ```text /antidupe verbosity off /antidupe verbosity low /antidupe verbosity med /antidupe verbosity high ``` Testing: ```text /dupe ``` --- # Recommended Deployment Begin with: ```yaml mode: AUDIT ``` Test normal server mechanics including: - Player Crafting - Crafting Tables - Anvils - Smithing Tables - Grindstones - Stonecutters - Cartography Tables - Looms - Furnaces - Blast Furnaces - Smokers - Brewing Stands - Villager Trading - Crafters - Bundles - Nested bundle contents - Shops - Hoppers - Ender Chests - Shulker Boxes - Stack Splitting - Stack Merging - Custom Commands - Private Vaults - Modded/Plugin Containers - Cross-server Transfers Also test every plugin that can: - Create items - Delete items - Transfer items - Modify inventories - Restore inventories - Store inventories externally - Create custom GUIs - Modify bundles - Grant Creative mode - Modify OP state Once normal server behavior has been validated: ```yaml mode: QUARANTINE ``` Quarantine mode follows the core safety sequence: 1. Preserve the legitimate/original item when it can be identified. 2. Back up the suspected duplicate. 3. Remove the confirmed excess. 4. Record the incident. 5. Notify administrators. 6. Send configured Discord alerts. 7. Allow administrator recovery. --- # Anti-Dupe 3.3 Anti-Dupe 3.3 expands the original 3.2 protection model with: - Vanilla-aware transaction handling - Crafting false-positive prevention - Dedicated workstation protection - Bundle-aware transaction accounting - Recursive nested bundle scanning - Custom command transfer monitoring - Plugin-managed vault monitoring - Small-transfer pattern detection - Identity-integrity protection - Inventory rollback support - Multiple database backends - Automatic database migrations - Velocity/Bungee network coordination - Cross-server transfer protection - World-aware enforcement - Exploit fingerprint classification - OP authorization protection - Creative-mode authorization protection - In-game OP whitelist management - In-game Creative whitelist management - Security UUID persistence - Security-management permissions - Bundled administrator documentation - Updated language infrastructure - Automatic language-file migration - Malformed YAML detection and recovery - bStats integration - Discord alerts - Daily logging - Safe duplicate recovery 

# Anti-Dupe 3.2 Update Anti-Dupe 3.2 is one of the largest updates to the plugin so far, introducing major improvements to compatibility, detection accuracy, logging, and overall server administration. The focus of this release is to eliminate false positives caused by legitimate item transactions while continuing to provide strong protection against duplication exploits. --- # Trusted Transaction Framework One of the biggest additions in Anti-Dupe 3.2 is the new **Trusted Transaction Framework**. Rather than assuming every increase in item count is suspicious, Anti-Dupe now determines **where the item came from** before deciding whether enforcement is required. Legitimate item creation can now be recognized from trusted plugin sources while unexplained item creation continues to be treated as suspicious. This dramatically reduces false positives without weakening duplicate detection. --- # Trusted Plugin Whitelisting Anti-Dupe no longer blindly trusts every custom inventory. Instead, transactions are only considered legitimate when **both** of the following conditions are true: 1. The inventory title matches an approved shop pattern. 2. The inventory originates from a trusted plugin. Example configuration: ```yaml compatibility: external-plugin-inventories: enabled: true grace-delay-ticks: 4 trusted-plugins: - UltimateShop title-patterns: - shop - store - market ``` Only inventories from approved plugins using approved titles receive the transaction grace period. This provides significantly stronger protection than trusting inventory titles alone. Additional shop plugins can easily be added: ```yaml trusted-plugins: - UltimateShop - EconomyShopGUI - ShopGUIPlus ``` Plugin matching is case-insensitive. --- # Improved Shop Plugin Compatibility Anti-Dupe 3.2 now works correctly with most modern shop plugins. Examples include: - UltimateShop - EconomyShopGUI - ShopGUIPlus - Other compatible inventory-based shop plugins When a trusted shop plugin grants an item: - The purchase is recognized as legitimate. - The ledger is updated automatically. - Newly created items are registered normally. - No duplicate warning is generated. - No recovery entry is created. - No Discord alert is sent. - No false positive occurs. This allows server economies to function normally while Anti-Dupe continues monitoring for genuine duplication exploits. --- # Trusted Inventory Matching To reduce the attack surface, Anti-Dupe only trusts shop-style inventory titles by default. Default patterns: ```yaml title-patterns: - shop - store - market ``` Examples that match: - Ultimate Shop - Server Shop - Diamond Store - Global Market - Black Market Examples that do **not** match: - Quest Rewards - Daily Rewards - Kits - Admin Panel - Warp Menu - Teleport GUI --- # Configurable Transaction Grace Window Some plugins complete inventory transactions slightly after the player clicks inside the GUI. Anti-Dupe now allows a configurable grace period to let trusted plugins finish their work. ```yaml grace-delay-ticks: 4 ``` During this short window: - Legitimate purchases are accepted. - Ledger entries are updated. - UUID registration still occurs. - Duplicate detection resumes immediately afterward. --- # Console Logging Verbosity Many server owners requested less console spam. Anti-Dupe 3.2 now includes configurable console verbosity levels. ```yaml warnings: console: true console-verbosity: low ``` Available levels: | Level | Description | |--------|-------------| | **off** | Suppresses routine Anti-Dupe console messages | | **low** | Startup information and confirmed detections/removals | | **med** | Includes scheduled scan summaries and manual scans | | **high** | Includes diagnostics and administrative testing information | Critical safety messages are **always displayed**, regardless of verbosity. Discord alerts, recovery backups, and administrator notifications are **not affected** by this setting. --- # Improved Detection Accuracy The transaction ledger has been expanded to better distinguish between: - Legitimate purchases - Legitimate crafting - Inventory movement - Stack splitting - Stack merging - Hopper transfers - Custom plugin transactions while continuing to detect: - Unauthorized item creation - Duplicate UUIDs - Quantity inconsistencies - Cross-inventory duplication --- # Ledger Improvements The Anti-Dupe ledger now automatically records trusted purchases from approved plugins. Each legitimate transaction updates the authoritative item ledger, ensuring future inventory audits remain accurate without "learning" duplicated quantities. This greatly improves long-term reliability while reducing false positives. --- # New Features - ✅ Trusted Transaction Framework - ✅ Trusted Plugin Whitelist - ✅ Shop plugin compatibility - ✅ UltimateShop compatibility - ✅ Configurable trusted plugin list - ✅ Trusted inventory title matching - ✅ Transaction grace window - ✅ Automatic ledger updates - ✅ Configurable console verbosity - ✅ Reduced console spam - ✅ Improved detection accuracy - ✅ Better inventory transaction handling - ✅ Stronger protection against malicious GUI plugins - ✅ Continued support for Discord alerts - ✅ Continued support for recovery backups - ✅ Continued support for administrator notifications --- # Why This Matters Many anti-dupe plugins struggle to distinguish between legitimate item generation and duplication exploits. Anti-Dupe 3.2 solves this by introducing trusted transaction authorization. Instead of simply detecting that an inventory increased, the plugin now verifies **why** it increased. Legitimate transactions are accepted. Unauthorized transactions continue through the normal detection pipeline. This dramatically improves compatibility with modern Minecraft server ecosystems while preserving Anti-Dupe's primary goal of protecting server economies from item duplication. Server owners no longer have to choose between using economy plugins and maintaining strong anti-dupe protection. Anti-Dupe now provides both. --- # Looking Forward The Trusted Transaction Framework introduced in Anti-Dupe 3.2 lays the groundwork for even deeper plugin integration in future releases. Future compatibility may include: - Native plugin API for transaction authorization - Auction House support - Crate plugin integration - Quest reward integration - Economy plugin integration - Custom crafting system support - Cross-server transaction synchronization - Advanced plugin trust management Anti-Dupe continues to evolve from a traditional inventory scanner into a comprehensive item transaction authority, designed to protect modern Paper servers while remaining compatible with complex plugin ecosystems.

# Anti-Dupe 3.1 — Hybrid Deep Scanner ## Overview Anti-Dupe 3.1 uses a hybrid detection system combining: - Immediate event-based verification - Periodic inventory audits - Ender Chest scanning - Loaded container scanning - Cross-inventory UUID checks - Ledger integrity audits - Optional deep scans - Automatic chunk-load scans - Safe recovery backups - Daily log files - Discord webhook alerts - Multi-language support - Admin whitelist - Original item preservation - Stack-safe accounting - SQLite transaction ledger --- # Scanner Configuration ```yaml scanner: enabled: true online-inventory-minutes: 5 ender-chest-minutes: 10 loaded-containers-minutes: 15 uuid-crosscheck-minutes: 15 ledger-audit-minutes: 30 players-per-batch: 10 automatic-chunk-scans: true chunk-scan-delay-ticks: 20 ``` Scanner tasks are staggered to prevent lag spikes. --- # Scan Frequency | Scan | Default | |------|--------:| | Online Player Inventories | Every 5 minutes | | Online Player Ender Chests | Every 10 minutes | | Loaded Containers | Every 15 minutes | | Cross Inventory UUID Check | Every 15 minutes | | Ledger Integrity Audit | Every 30 minutes | Player scans are processed in configurable batches. --- # Immediate Event Verification Immediately verifies all inventory transactions after Minecraft completes them. Protected events include: - Inventory Click - Shift Click - Number Key Swap - Drag Distribution - Stack Split - Stack Merge - Double Click Collect - Offhand Swap - Hopper Transfer - Item Pickup - Item Drop - Crafting - Smithing - Anvil - Grindstone - Villager Trading - Player Login - Player Logout - Container Open - Container Close Cursor items are included in every transaction snapshot preventing false positives during normal stack splitting. --- # Deep Scan Commands Scan everything: ``` /antidupe scan all ``` Scans: - Online Players - Ender Chests - Loaded Containers - Chest Minecarts - Hopper Minecarts - Inventory Holding Entities - UUID Registry - Stack Fingerprints - Ledger Totals Player inventories: ``` /antidupe scan players ``` Ender Chests: ``` /antidupe scan ender ``` Loaded Containers: ``` /antidupe scan containers ``` Current Chunk: ``` /antidupe scan chunk ``` --- # Automatic Chunk Scanning Whenever a chunk loads: - Wait 20 ticks - Scan every inventory holder Supported block inventories: - Chest - Trapped Chest - Barrel - Shulker Box - Hopper - Furnace - Blast Furnace - Smoker - Crafter - Brewing Stand - Dropper - Dispenser Supported entities: - Chest Minecart - Hopper Minecart - Inventory Holding Entities --- # Safe Removal & Recovery Before removal: Complete ItemStack is written to: ``` plugins/Anti-Dupe/recovery.yml ``` Stored: - Material - Amount - Name - Lore - Enchantments - Durability - Components - Persistent Data - UUID - Player - World - Coordinates - Detection Reason - Timestamp - Recovery ID - Restore Status If writing fails: - Item remains untouched - Severe error logged --- # Recovery Commands Recent entries ``` /antidupe recovery list ``` Lookup player ``` /antidupe recovery player <player> ``` Restore original owner ``` /antidupe recovery restore <id> ``` Restore to another player ``` /antidupe recovery restore <id> <player> ``` Permission: ``` antidupe.recovery ``` --- # Admin Whitelist Add ``` /antidupe whitelist add <player> ``` Remove ``` /antidupe whitelist remove <player> ``` Check ``` /antidupe whitelist check <player> ``` List ``` /antidupe whitelist list ``` Stored: ``` plugins/Anti-Dupe/admin-whitelist.yml ``` Permission: ``` antidupe.whitelist ``` --- # Admin Test Command ``` /dupe ``` Duplicates the held item. Ignores: - Whitelist - OP - antidupe.bypass Used strictly for testing. Permission: ``` antidupe.dupe ``` --- # Private Detection Warnings Players never receive detection messages. Warnings go only to: - Server Console - Admins - Daily Log Files - Discord Permission: ``` antidupe.notify ``` --- # Daily Logs Location ``` plugins/Anti-Dupe/logs/ ``` Filename ``` anti-dupe-YYYY-MM-DD.log ``` Automatically rotates every day. --- # Discord Webhook Alerts Rich embed notifications. Config: ```yaml discord: enabled: true webhook-url: "" username: "Anti-Dupe" avatar-url: "" locale: en_US embed-color: "#FFB000" include-coordinates: true role-mention: "" ``` Embed contains: - Player - UUID - World - Coordinates - Time - Detection Reason - Removed Item - Removed Quantity - Recovery ID - Confirmation Item Removed Webhook runs asynchronously. --- # Multi-Language Support Supported locales: - de_DE - en_US - es_ES - fr_CA - fr_FR - it_IT - ja_JP - pl_PL - pt_BR - ru_RU - tr_TR - uk_UA - zh_CN Config: ```yaml language: default: en_US use-client-locale: true ``` Language files: ``` plugins/Anti-Dupe/lang/ ``` Discord may use a separate locale. --- # Permissions ``` antidupe.admin antidupe.notify antidupe.whitelist antidupe.recovery antidupe.dupe antidupe.bypass ``` --- # Recommended Deployment Start in: ```yaml mode: AUDIT ``` Test: - Crafting - Smelting - Trading - Hoppers - Stack Splitting - Stack Merging - Ender Chests - Shulker Boxes - Modded Containers After validation: ```yaml mode: QUARANTINE ``` Quarantine mode: 1. Preserve original item. 2. Backup duplicate. 3. Remove duplicate. 4. Log incident. 5. Notify admins. 6. Send Discord alert. 7. Allow administrator restoration. ---

- Fixed broken drop mechanics in inventory. - Compatibility issues fixed, now works with 1.21.x. - Removed ban managment, all information logged to dupe_log.yml or reported to discord.

- Fixed Anti-Dupe not logging to dupe_log.yml. - Fixed Anti-Dupe not loading all language files.  If you have any suggestions or corrections regarding translations in your native language file, please let me know. **Discord:** https://discord.com/invite/SfEHT6TEdm