Download File

# Anti-Dupe 3.5 ## Advanced item-duplication protection for Paper servers **Anti-Dupe 3.5** combines live transaction verification, persistent quantity accounting, signed unique-item identities, cross-inventory scanning, and safe administrator recovery in one complete Paper security system. It is designed for vanilla and customized servers that need strong detection without making everyday inventory management difficult. > **Verify item creation, preserve the original, secure the evidence, and give staff > a fast way to review and restore anything they need.** --- # What Is New in 3.5 Anti-Dupe 3.5 greatly expands incident forensics. When a dupe happens, staff can now determine **Who / What / When / Where**, while the new **Chunk Audit** and **Command Audit** provide evidence that may help explain **why and how** the duplication occurred. New incidents now record: - Backend server, world, and precise coordinates - Nearby players within 32 blocks - Player UUID, distance, and optional game mode - Subject-versus-nearby incident history - Repeat nearby-appearance counts - A fixed **3×3 chunk audit area**: the offender's chunk plus all eight neighbouring chunks - Redstone, mechanisms, storage blocks, exact coordinates, and totals - The offender's last **10 player-issued commands** when an incident begins - Commands displayed newest-first with timestamps and allowed/cancelled state - Automatic redaction of passwords, PINs, OTPs, tokens, and authentication arguments   The 3.5 release also includes: - Player → incidents → incident-items recovery workflow - Individual and incident-wide restoration - Back navigation throughout the recovery interface - Persistent global quantity ledger - HMAC-SHA256 signed identities for unique items - Automatic version-1 to version-2 identity migration - Two-stage enforcement using independent confirmation reads - Atomic cross-server inventory transfers - Exclusive database-backed player leases - One-time network transfer claims and inventory hashes - Trusted-plugin authorization without inventory-title patterns - Holderless custom-GUI attribution - Full exemption for Anti-Dupe-owned menus - Combined inventory, cursor, and material-level conservation - Automated detection simulations and regression testing - SQLite, MySQL, MariaDB, and PostgreSQL support --- # Lag Reduction and Further Optimization Anti-Dupe 3.5 continues to spread expensive work across multiple ticks and avoids unnecessary repeated scans. The goal is to preserve strong detection and forensic evidence while minimizing impact on TPS and normal gameplay. Performance and lag-reduction measures include: - **One chunk per tick** processing for 3×3 incident chunk audits - Staggered scheduled scans instead of running every audit simultaneously - Configurable batching for player, Ender Chest, container, UUID, and ledger scans - Delayed chunk scans that confirm a chunk is still loaded before inspecting it - Two-stage enforcement that lets transactions settle before performing confirmation reads - Movement stabilization for joins, teleports, portals, world changes, rapid chunk transitions, and high-speed Elytra travel - Asynchronous Discord webhook delivery after evidence has been saved and enforcement completed - Focused 3×3 incident auditing instead of unrestricted world-wide mechanism scanning - Bounded command history collection limited to the last 10 player-issued commands per incident - Persistent database-backed ledger, recovery, and network-transfer state to avoid unnecessary reconstruction work Together, these optimizations keep heavier forensic work bounded and distribute it over time, reducing single-tick workload while retaining the information administrators need to investigate duplication incidents. --- # Core Features - Immediate inventory transaction verification - Persistent authorized-supply accounting - Stack-safe canonical item fingerprints - Signed UUID identities for non-stackable items - Cross-inventory duplicate detection - Two-stage confirmation before normal quarantine - Player, Ender Chest, container, and entity scanning - Automatic delayed chunk scanning - High-speed movement and chunk-transition stabilization - Trusted shop and reward-plugin compatibility - Crafting and workstation transaction handlers - Bundle and nested-item accounting - Monitored plugin-command transfers - Plugin-managed storage auditing - Safe item recovery and complete inventory rollback - World-specific audit and quarantine rules - Velocity and BungeeCord backend coordination - Known exploit-pattern classification - Private staff notifications and daily logs - Discord webhook alerts - 28 locale variants - Operator and Creative Mode protection - Administrator testing tools --- # Detection Architecture Anti-Dupe does not depend on one periodic scan or one piece of item metadata. Version 3.5 combines several independent evidence layers: ```text Live Transaction Verification + Persistent Quantity Ledger + Signed Unique Identities + Cross-Inventory Scanning + Independent Confirmation ↓ Confirmed Incident Evidence ``` This lets Anti-Dupe distinguish ordinary item movement from actual quantity creation while retaining strong evidence for administrator review. --- # Persistent Global Quantity Ledger Anti-Dupe maintains a persistent authorized-supply ceiling for every observed stackable fingerprint. The first complete startup scan establishes the existing supply. After that, validated vanilla outputs and approved trusted-plugin grants add idempotent authorization records to the configured database. Repeated global observations above authorized supply become confirmed ledger incidents. Global reconciliation currently operates as a reporting layer, allowing staff to investigate confirmed excess before applying broader enforcement to servers with custom item-generation plugins. ```yaml persistent-global-ledger: enabled: true startup-baseline-delay-ticks: 40 learning-period-minutes: 1440 required-matching-scans: 2 ``` The ledger persists across restarts and never authorizes a transaction twice when the same transaction ID is replayed. --- # Signed Unique-Item Identities Non-stackable items receive a hidden serial UUID protected by HMAC-SHA256. The signature authenticates: - Identity version - Unique serial UUID - Issuing server Names, damage, repairs, enchantments, and other legitimate item changes are tracked separately, so the stable signed identity can continue to follow the same item. Version 3.5 automatically upgrades unsigned legacy items and authentic version-1 identities to the current version-2 format. The signing key is generated at: ```text plugins/Anti-Dupe/identity.key ``` Back up this file. Every backend in a network must use the same identity key. --- # Two-Stage Enforcement Normal quantity and identity detections require independent confirmation. ```text First Observation ↓ Record Candidate ↓ Wait for the Transaction to Settle ↓ Read Fresh Inventory State ↓ Evidence Still Present? / \ No Yes ↓ ↓ Clear Confirm ↓ Backup and Quarantine ``` ```yaml two-stage-enforcement: enabled: true required-matches: 2 confirmation-delay-ticks: 3 candidate-expiry-seconds: 30 ``` The administrator-only `/dupe` diagnostic remains immediate so staff can verify the configured enforcement mode on demand. --- # Transaction and Material Conservation Inventory clicks are evaluated across the complete transaction scope: - Top inventory - Player inventory - Cursor/carried item - Nested bundle contents Anti-Dupe also verifies the combined material quantity. A fingerprint transition with no material increase is treated as an item-state change, while genuine quantity growth continues through confirmation. Protected transaction families include: - Inventory click and drag - Pickup All and Place All - Shift-click and number-key transfers - Stack split, merge, and double-click collection - Offhand swaps - Hopper transfers - Crafting Tables and player crafting - Furnaces, Blast Furnaces, and Smokers - Smithing Tables, Anvils, and Grindstones - Brewing Stands and Crafters - Stonecutters, Cartography Tables, and Looms - Villager trading - Bundle transfers - Player joins and network transitions - Monitored plugin commands - Plugin-managed storage open and close operations --- # Trusted Plugin Compatibility Trusted shops, crates, quests, rewards, and other approved systems can authorize the items they legitimately grant. ```yaml compatibility: external-plugin-inventories: enabled: true grace-delay-ticks: 4 trusted-plugins: - UltimateShop - EconomyShopGUI - ShopGUIPlus ``` Trust is based on the plugin that owns or opens the custom inventory. **GUI titles are not used as a trust requirement.** Holderless custom menus are attributed from the plugin call that opened them. Physical inventories such as chests, barrels, player inventories, and entity inventories remain under normal verification. Accepted trusted grants: - Update transaction history - Add authorized supply to the global ledger - Normalize signed identities when required - Keep the rest of the player's inventory protected > ⚠️ **Trusted Plugin Warning:** A trusted plugin becomes an intentional item-creation > authority. Keep this list small, use reputable plugins, and monitor their security > updates. --- # Crafting and Workstation Protection Virtual result previews are handled separately from owned inventory contents. Anti-Dupe validates consumed inputs and authorizes the corresponding output only after Minecraft has completed the transaction. This includes shift-crafted output, crafting remainder items, repeated villager trades, and workstation result collection. --- # Bundle Protection Items inside vanilla bundles remain part of the player's total ownership. ```text Bundle Contents ↕ Cursor ↕ Player Inventory ``` Moving an item between these locations conserves the total. Recursive accounting can also inspect nested supported contents. ```yaml transaction-handlers: bundles: enabled: true delay-ticks: 2 include-contained-items-in-accounting: true recursive-content-check: true ``` --- # Cross-Inventory Protection Anti-Dupe compares signed UUIDs across: - Player inventories - Ender Chests - Chests and Trapped Chests - Barrels and Shulker Boxes - Hoppers - Furnaces, Smokers, and Blast Furnaces - Brewing Stands - Droppers and Dispensers - Crafters - Chest and Hopper Minecarts - Other loaded inventory-holding entities If the same identity is confirmed in independent live locations, Anti-Dupe preserves the registered original, backs up the conflicting copy, creates a recovery incident, and applies the configured world policy. Movement stabilization accounts for joins, teleports, portals, world changes, rapid chunk transitions, and high-speed Elytra travel before cross-inventory enforcement. --- # Automatic and Manual Scanning Scheduled scans are staggered and processed in configurable batches. | Scan | Default Interval | |------|-----------------:| | Online Player Inventories | 5 minutes | | Ender Chests | 10 minutes | | Loaded Containers | 15 minutes | | Cross-Inventory UUID Check | 15 minutes | | Ledger Audit | 30 minutes | Manual commands: ```text /antidupe scan all /antidupe scan players /antidupe scan ender /antidupe scan containers /antidupe scan chunk ``` Delayed chunk scans verify that a chunk is still loaded before inspecting it, keeping the evidence tied to a current live inventory. --- # Atomic Network Transfers Anti-Dupe 3.5 provides database-backed coordination for Velocity and BungeeCord networks. When a player leaves a backend, Anti-Dupe commits: - A unique transfer ID - The source and destination state - An ordered SHA-256 inventory hash - Storage slots - Armor slots - Offhand slot - Ender Chest slots - Transfer expiry information The destination must atomically claim the transfer and present the matching arrival hash. Player leases prevent the same player inventory from being active on two backends at once, and each transfer can be claimed only once. Network requirements: - Install Anti-Dupe on every Paper backend - Use one shared MySQL, MariaDB, or PostgreSQL database - Give every backend a unique `network.server-id` - Use the same `identity.key` or shared signing secret everywhere ```yaml network: enabled: false proxy: NONE server-id: survival-1 player-lease-seconds: 45 reject-join-while-locked: true inventory-mismatch-action: KICK shared-ledger: true cross-server-uuid-checks: true cross-server-stack-accounting: true ``` Standalone Paper servers can leave network mode disabled. --- # Inventory Rollbacks Anti-Dupe can store complete player snapshots containing inventory storage, armor, offhand, and Ender Chest contents. ```text /antidupe rollback list [player] /antidupe rollback snapshot /antidupe rollback restore <id> [player] ``` Rollback snapshots complement item-level recovery when staff need to restore a broader inventory state. --- # World-Aware Rules Different worlds can use different policies: ```yaml world-rules: enabled: true default-mode: inherit worlds: world: mode: inherit creative: mode: audit scan-ender-chest: false ``` Available world modes are: - `inherit` - `disabled` - `audit` - `quarantine` --- # Operator and Creative Protection Optional UUID-based security can restrict operator status and Creative Mode access. ```text /antidupe opprot add <player> /antidupe opprot remove <player> /antidupe opprot list /antidupe creativeprot add <player> /antidupe creativeprot remove <player> /antidupe creativeprot list ``` > ⚠️ Configure every legitimate administrator UUID before enabling OP protection. > An empty allowed list means nobody is authorized. --- # Database Support Supported database backends: - SQLite - MySQL - MariaDB - PostgreSQL SQLite is ready for standalone installations. Network mode requires all backends to share the same remote database. Automatic schema migrations preserve compatible data as Anti-Dupe evolves. --- # Private Reporting and Discord Alerts Detection details are sent to controlled administrator channels: - Paper console - Staff with `antidupe.notify` - Daily UTF-8 log files - Discord webhook, when configured Daily logs are stored under: ```text plugins/Anti-Dupe/logs/anti-dupe-YYYY-MM-DD.log ``` Discord delivery is asynchronous and occurs only after recovery evidence has been saved and enforcement has completed. Console verbosity can be changed without disabling recovery, Discord, daily logs, or staff notifications: ```text /antidupe verbosity off /antidupe verbosity low /antidupe verbosity med /antidupe verbosity high ``` --- # Multi-Language Support Anti-Dupe 3.5 includes **28 locale variants** with optional client-locale detection: `ar_SA`, `cs_CZ`, `da_DK`, `de_DE`, `el_GR`, `en_US`, `es_ES`, `fi_FI`, `fr_CA`, `fr_FR`, `he_IL`, `hi_IN`, `hu_HU`, `id_ID`, `it_IT`, `ja_JP`, `ko_KR`, `nl_NL`, `no_NO`, `pl_PL`, `pt_BR`, `ro_RO`, `ru_RU`, `sv_SE`, `tr_TR`, `uk_UA`, `zh_CN`, and `zh_TW`. ```yaml language: default: en_US use-client-locale: true ``` --- # Commands ```text /antidupe status /antidupe audit /antidupe scan <all|players|ender|containers|chunk> /antidupe recovery /antidupe recovery player <player> /antidupe recovery restore <id> [player] /antidupe rollback list [player] /antidupe rollback snapshot /antidupe rollback restore <id> [player] /antidupe whitelist add <player> /antidupe whitelist remove <player> /antidupe whitelist check <player> /antidupe whitelist list /antidupe opprot <add|remove|list> /antidupe creativeprot <add|remove|list> /antidupe verbosity <off|low|med|high> /antidupe reload /dupe ``` --- # Permissions ```text antidupe.admin antidupe.notify antidupe.whitelist antidupe.recovery antidupe.rollback antidupe.security antidupe.dupe antidupe.bypass ``` --- # Recommended Deployment Anti-Dupe requires **Paper 1.21.x** and **Java 21**. For a new installation: 1. Install the JAR and start the server once. 2. Back up `plugins/Anti-Dupe/identity.key`. 3. Configure trusted item-granting plugins. 4. Begin with `mode: AUDIT`. 5. Test your crafting, shops, rewards, containers, bundles, and network transfers. 6. Run `/dupe` in a controlled environment to verify detection. 7. Switch to `mode: QUARANTINE` when ready. Never delete or replace `identity.key` during an upgrade. Network servers must share the same key and remote database. --- # Detection Regression Suite The 3.5 source project includes **46 automated tests** covering: - Legitimate and illegitimate quantity paths - Inventory pickup/place conservation - Trusted grants - Signed-identity tampering and legacy migration - Two-stage candidate confirmation - Persistent database state across restart - Idempotent transaction authorization - Exclusive player leases - Transfer hash matching - Concurrent and replayed transfer claims Build verification also checks that the deployable shaded JAR contains `plugin.yml` and all required database drivers. --- # bStats Metrics Anti-Dupe uses bStats plugin ID **25245** for anonymous usage and configuration statistics. Custom charts do not include player names, UUIDs, IP addresses, inventory contents, recovery data, coordinates, webhook URLs, whitelist entries, or trusted plugin names. Global bStats controls are available through the standard bStats configuration.