
Anti-Dupe
A security tool for Minecraft servers, designed to prevent item duplication exploits.
Список изменений
!Anti-Dupe
Anti-Dupe
Overview
Anti-Dupe 3.3 is an advanced anti-duplication and server-security system for Paper Minecraft servers.
Rather than relying solely on periodic inventory scanning, Anti-Dupe combines:
- Transaction ledger accounting
- Immediate event verification
- Cross-inventory auditing
- Trusted transaction authorization
- UUID tracking
- Stack-safe accounting
- Automatic chunk scanning
- Deep inventory auditing
- Safe recovery and rollback systems
- Operator and Creative Mode protection
- High-speed movement stabilization
- Cross-inventory confirmation
- Discord notifications
- Multi-language support
Anti-Dupe is designed to protect both vanilla and heavily customized servers while minimizing interference with legitimate gameplay.
The goal is simple:
Legitimate item movement should remain invisible to players, while unauthorized item creation should be detected, preserved for review, and safely removed.
Core Features
- Immediate event-based verification
- Hybrid inventory scanning
- Transaction Ledger
- Trusted Transaction Framework
- Trusted Plugin Whitelisting
- Shop Plugin Compatibility
- Stack-safe accounting
- UUID tracking for unique items
- Cross-inventory duplicate detection
- Cross-inventory confirmation system
- High-speed movement stabilization
- Stale container protection
- Automatic chunk scanning
- Deep inventory auditing
- Safe removal & recovery
- Inventory rollback system
- SQLite transaction database
- Database migration support
- Network support architecture for Velocity/Bungee
- World-aware protection rules
- Exploit fingerprint system
- Daily rotating log files
- Discord webhook alerts
- Multi-language support
- Console verbosity controls
- Administrator whitelist
- Operator protection
- Creative Mode protection
- Original item preservation
- Bundle transaction protection
- Crafting workstation transaction handling
- bStats metrics support
Trusted Transaction Framework
One of Anti-Dupe's core systems is the Trusted Transaction Framework.
Instead of assuming every increase in inventory is suspicious, Anti-Dupe attempts to determine why an item was created before enforcement occurs.
Legitimate item generation can be authorized by trusted systems including:
- Shop plugins
- Economy plugins
- Reward systems
- Custom inventories
- Other approved transaction sources
This significantly reduces false positives while maintaining duplicate detection for unauthorized item creation.
Trusted Plugin Compatibility
Anti-Dupe does not automatically trust every custom inventory.
Transactions are considered trusted only when the configured compatibility requirements are met.
Example:
compatibility:
external-plugin-inventories:
enabled: true
grace-delay-ticks: 4
trusted-plugins:
- UltimateShop
title-patterns:
- shop
- store
- market
Additional trusted plugins may be added:
trusted-plugins:
- UltimateShop
- EconomyShopGUI
- ShopGUIPlus
Inventory title matching is case-insensitive.
The default approved title patterns remain intentionally limited to:
title-patterns:
- shop
- store
- market
This reduces the attack surface compared with blindly trusting custom inventories.
⚠️⚠️⚠️ Trusted Plugin Security Warning ⚠️⚠️⚠️
Adding a plugin to trusted-plugins tells Anti-Dupe to accept qualifying transactions originating from that plugin as legitimate.
This creates an intentional trust boundary.
If a trusted plugin contains:
- A duplication glitch
- Item-generation bug
- Transaction exploit
- Reward exploit
- Shop exploit
- Crate exploit
- Auction exploit
- Economy exploit
Anti-Dupe may treat the resulting items as legitimate because they originated from a source explicitly trusted by the administrator.
For example:
Trusted Shop Plugin
↓
Plugin bug generates 64 items instead of 1
↓
Anti-Dupe sees an authorized transaction
↓
Ledger may accept the increase
Anti-Dupe cannot reliably protect a server from a system the administrator has explicitly instructed it to trust.
Only whitelist plugins that you:
- Fully trust
- Keep updated
- Have tested carefully
- Obtained from reputable sources
- Actively monitor for exploit reports
- Actually require to generate items
Keep the trusted-plugin list as small as possible.
Removing a plugin from trusted-plugins restores normal Anti-Dupe enforcement for its transactions.
Shop Plugin Support
Anti-Dupe supports inventory-based shop systems through the Trusted Transaction Framework.
Examples include:
- UltimateShop
- EconomyShopGUI
- ShopGUIPlus
- Similar inventory-based shop plugins
Trusted purchases can:
- Update the ledger automatically
- Register newly created items
- Avoid false duplicate warnings
- Avoid unnecessary recovery entries
- Avoid unnecessary Discord alerts
- Continue protecting the player's remaining inventory
Immediate Event Verification
Anti-Dupe verifies inventory transactions after Minecraft finishes processing them.
Protected events include:
- Inventory Click
- Shift Click
- Number Key Swap
- Drag Distribution
- Stack Split
- Stack Merge
- Double Click Collect
- Offhand Swap
- Hopper Transfer
- Item Pickup
- Item Drop
- Crafting
- Smithing
- Anvil
- Grindstone
- Villager Trading
- Player Login
- Player Logout
- Container Open
- Container Close
Cursor items are included in transaction snapshots to prevent normal item movement from appearing to create additional items.
Crafting & Workstation Protection
Anti-Dupe 3.3 includes improved handling for crafting and workstation inventories.
This was introduced to prevent legitimate ingredient consumption and result creation from appearing as unauthorized inventory changes.
Supported transaction handling includes:
- Crafting Tables
- Player Crafting
- Furnaces
- Blast Furnaces
- Smokers
- Smithing Tables
- Anvils
- Grindstones
- Brewing Stands
- Crafters
- Villager Trading
Anti-Dupe waits for Minecraft to complete the transaction before evaluating the resulting inventory state.
This prevents situations where:
Input exists
↓
Craft executes
↓
Output appears
↓
Input disappears
from temporarily being interpreted as:
Input exists
+
Output exists
=
Unexpected item increase
Bundle Transaction Protection
Anti-Dupe 3.3 includes special handling for Minecraft bundles.
Items stored inside a vanilla bundle are considered part of the player's total ownership.
Example:
Inventory:
32 Arrows
Bundle:
32 Arrows
Total ownership:
64 Arrows
Moving items between:
Bundle
↕
Cursor
↕
Player Inventory
does not represent item creation.
Example configuration:
transaction-handlers:
bundles:
enabled: true
delay-ticks: 2
include-contained-items-in-accounting: true
recursive-content-check: true
Removing arrows from a bundle therefore does not create a false positive simply because the same items temporarily appear on the cursor or elsewhere in the inventory transaction.
A genuine exploit that increases:
bundle + cursor + inventory
is still subject to normal Anti-Dupe enforcement.
Scanner Configuration
scanner:
enabled: true
online-inventory-minutes: 5
ender-chest-minutes: 10
loaded-containers-minutes: 15
uuid-crosscheck-minutes: 15
ledger-audit-minutes: 30
players-per-batch: 10
automatic-chunk-scans: true
chunk-scan-delay-ticks: 20
Scanner tasks are staggered to minimize server impact.
Scan Frequency
| Scan | Default |
|---|---|
| Online Player Inventories | Every 5 minutes |
| Ender Chests | Every 10 minutes |
| Loaded Containers | Every 15 minutes |
| Cross Inventory UUID Check | Every 15 minutes |
| Ledger Audit | Every 30 minutes |
Player scans are processed in configurable batches.
Cross-Inventory Protection
Anti-Dupe compares UUID-tracked items across inventories to detect cases where the same unique item appears in multiple locations.
Potential locations include:
- Player inventories
- Ender Chests
- Chests
- Barrels
- Shulker Boxes
- Hoppers
- Furnaces
- Other loaded containers
- Inventory-holding entities
- Chest Minecarts
- Hopper Minecarts
A cross-inventory detection is treated separately from normal quantity accounting.
High-Speed Movement Stabilization
Anti-Dupe 3.3 adds additional protection against false cross-inventory detections caused by extremely rapid player movement.
This is particularly important for:
- Elytra flight
- Nether travel
- Rapid chunk transitions
- Teleportation
- Portal travel
- World changes
- Server joins
- Network/server transitions
At high speeds, Minecraft may rapidly load and unload chunks while Anti-Dupe is inspecting inventories.
Without stabilization, a situation such as:
Old container observation
+
Player inventory
↓
Same UUID temporarily appears twice
could potentially look like a duplicate even though one observation is stale.
Anti-Dupe therefore introduces a stabilization period before cross-inventory enforcement.
Example:
cross-inventory-protection:
stabilization:
enabled: true
after-join-ticks: 60
after-chunk-change-ticks: 10
after-world-change-ticks: 40
after-teleport-ticks: 20
after-portal-ticks: 40
high-speed:
enabled: true
blocks-per-second-threshold: 25.0
stabilization-ticks: 10
High-speed movement does not exempt a player from Anti-Dupe.
It only delays cross-inventory enforcement until the player's inventory and surrounding chunk state have stabilized.
Cross-Inventory Confirmation
Cross-inventory detections can require confirmation before quarantine.
Example:
cross-inventory-protection:
confirmation:
enabled: true
delay-ticks: 3
required-matches: 2
candidate-expiry-seconds: 30
Instead of:
Duplicate UUID observed
↓
Immediate quarantine
Anti-Dupe can perform:
Duplicate UUID observed
↓
Record candidate
↓
Wait
↓
Fresh inventory scan
↓
Duplicate still exists?
/ \
No Yes
↓ ↓
Discard Confirm
↓
Quarantine
This protects against transient inventory states without allowing genuine duplicate UUIDs to escape detection.
Stale Container Protection
Delayed chunk scans verify that the target chunk is still loaded before scanning it.
A container observation from an unloaded or invalid chunk should not be treated the same as a currently accessible live inventory.
This is particularly useful when players travel rapidly through the Nether using Elytra, where large numbers of chunks can load and unload in a short period.
Cross-inventory detections are designed to favor fresh, identifiable inventory evidence over stale observations.
Deep Scan Commands
Scan everything:
/antidupe scan all
Scans:
- Online players
- Ender Chests
- Loaded containers
- Inventory-holding entities
- Chest Minecarts
- Hopper Minecarts
- UUID registry
- Stack fingerprints
- Ledger totals
Player inventories:
/antidupe scan players
Ender Chests:
/antidupe scan ender
Loaded containers:
/antidupe scan containers
Current chunk:
/antidupe scan chunk
Automatic Chunk Scanning
Whenever a chunk loads:
- Anti-Dupe waits for the configured delay.
- The chunk's inventory holders are inspected.
- The chunk must still be loaded when the delayed scan executes.
Default:
automatic-chunk-scans: true
chunk-scan-delay-ticks: 20
Supported block inventories include:
- Chest
- Trapped Chest
- Barrel
- Shulker Box
- Hopper
- Furnace
- Blast Furnace
- Smoker
- Crafter
- Brewing Stand
- Dropper
- Dispenser
Supported entities include:
- Chest Minecart
- Hopper Minecart
- Inventory-holding entities
Transaction Ledger
Unlike traditional anti-dupe plugins, Anti-Dupe maintains an authoritative transaction ledger.
Every legitimate item creation can update the ledger.
Examples include:
- Mining
- Crafting
- Smelting
- Trading
- Trusted shop purchases
- Approved plugin transactions
Unauthorized increases continue through duplicate detection.
The ledger does not intentionally "learn" duplicated quantities simply because they appeared in an inventory.
Stack-Safe Accounting
Stackable items retain normal Minecraft stacking behavior.
Rather than requiring every ordinary stack to behave like a unique item, Anti-Dupe combines:
- Item fingerprints
- Ledger totals
- Transaction accounting
- Cross-inventory quantity verification
This preserves vanilla stacking while detecting unauthorized quantity increases.
Unique Item Protection
Items requiring unique tracking can receive hidden UUID information.
Tracked information can include:
- UUID
- Player
- Inventory
- Slot
- Timestamp
- Fingerprint
When the same unique UUID is confirmed in multiple independent locations:
- Preserve the original.
- Backup the suspected duplicate.
- Remove the duplicate.
- Create a recovery record.
- Log the incident.
- Notify administrators.
- Send Discord notification if configured.
Safe Removal & Recovery
Anti-Dupe uses a backup-before-removal policy.
Before a suspected duplicate is removed, the complete ItemStack is written to:
plugins/Anti-Dupe/recovery.yml
Stored information can include:
- Material
- Amount
- Name
- Lore
- Enchantments
- Durability
- Components
- Persistent Data
- Player
- UUID
- World
- Coordinates
- Detection Reason
- Timestamp
- Recovery ID
- Restore Status
If the backup fails:
- The item remains untouched.
- A severe error is logged.
This prevents Anti-Dupe itself from permanently destroying an item that cannot first be recovered.
Recovery Commands
Recent recovery records:
/antidupe recovery list
Records for a player:
/antidupe recovery player <player>
Restore to original owner:
/antidupe recovery restore <id>
Restore to another player:
/antidupe recovery restore <id> <player>
Permission:
antidupe.recovery
Inventory Rollbacks
Anti-Dupe 3.3 includes inventory rollback functionality for situations where administrators need to restore an earlier inventory state.
Commands include:
/antidupe rollback list [player]
Create a snapshot:
/antidupe rollback snapshot
Restore a snapshot:
/antidupe rollback restore <id> [player]
Rollback functionality provides another recovery layer beyond individual quarantined items.
Administrator Whitelist
Add:
/antidupe whitelist add <player>
Remove:
/antidupe whitelist remove <player>
Check:
/antidupe whitelist check <player>
List:
/antidupe whitelist list
Stored in:
plugins/Anti-Dupe/admin-whitelist.yml
Permission:
antidupe.whitelist
Server Security Protection
Anti-Dupe 3.3 includes optional protections against unauthorized administrative privileges.
The security system can protect:
- Operator status
- Creative Mode access
These protections use UUID-based authorization.
Example:
security:
enabled: false
op-protection:
enabled: true
allowed-uuids: []
creative-protection:
enabled: true
allowed-uuids: []
fallback-gamemode: SURVIVAL
The main security system is intentionally disabled by default.
Administrators should configure their UUIDs before enabling it.
Operator Protection
Operator Protection prevents unauthorized players from obtaining or retaining OP status.
Authorized administrators can be managed in-game.
Add:
/antidupe opprot add <player>
Remove:
/antidupe opprot remove <player>
List:
/antidupe opprot list
The player's UUID is stored under:
security:
op-protection:
allowed-uuids: []
Player names can be selected using command completion where available.
UUID storage prevents simple username changes from bypassing the protection.
Creative Mode Protection
Creative Mode can also be restricted to explicitly authorized UUIDs.
Add:
/antidupe creativeprot add <player>
Remove:
/antidupe creativeprot remove <player>
List:
/antidupe creativeprot list
Stored under:
security:
creative-protection:
allowed-uuids: []
Unauthorized Creative Mode can be reverted to the configured fallback:
fallback-gamemode: SURVIVAL
Permission for the security-management commands:
antidupe.security
The main /antidupe command also requires:
antidupe.admin
⚠️ Operator Protection Setup Warning
Configure your administrator UUIDs before enabling the main security system.
If:
security:
enabled: true
op-protection:
enabled: true
allowed-uuids: []
then there are no authorized operator UUIDs.
Anti-Dupe may therefore treat every OP player as unauthorized.
The same principle applies to Creative Mode protection.
Recommended setup:
1. Install Anti-Dupe
2. Start the server
3. Add authorized administrators
4. Verify the UUID lists
5. Enable security
6. Restart/reload as appropriate
Database Support
Anti-Dupe uses persistent transaction storage for ledger and tracking information.
SQLite provides a local database suitable for single-server installations.
The database layer is designed to support migration as Anti-Dupe's schema evolves.
Database migration support allows newer plugin versions to update older stored data without requiring administrators to manually rebuild the Anti-Dupe database.
As with any server database, administrators should maintain regular backups.
Network Support
Anti-Dupe 3.3 includes architecture for multi-server environments using systems such as:
- Velocity
- BungeeCord
Network synchronization is intended to prevent an item from appearing legitimate simply because it moved between backend servers.
Network-aware protection can be used to coordinate Anti-Dupe state across connected servers rather than treating every backend as an entirely independent economy.
Configuration should remain optional so standalone Paper servers do not require proxy infrastructure.
World-Aware Rules
Anti-Dupe can use world-aware protection policies so administrators can apply different rules to different environments.
Examples include:
- Survival worlds
- Creative worlds
- Event worlds
- Minigame worlds
- Resource worlds
- Lobby worlds
This is useful when a server intentionally allows behavior in one world that should never be accepted in another.
Administrators should keep exemptions as narrow as possible.
Exploit Fingerprint Database
Anti-Dupe 3.3 includes support for identifying known duplication behavior through exploit fingerprints.
Rather than relying entirely on a single inventory count, exploit fingerprints can describe suspicious transaction patterns associated with known duplication techniques.
Potential fingerprint information includes:
- Transaction sequence
- Inventory type
- Item movement pattern
- Timing
- Quantity change
- Container interaction
- Repeated UUID behavior
Fingerprint-based detection supplements the normal ledger, UUID, and inventory systems rather than replacing them.
Testing Command
/dupe
The administrator-only testing command intentionally duplicates the held item.
It is designed to verify that Anti-Dupe's detection and quarantine systems are working.
The test ignores:
- Administrator whitelist
- OP status
antidupe.bypass
Permission:
antidupe.dupe
⚠️ Use /dupe only on a test server or in a controlled environment.
Console Verbosity
Anti-Dupe includes configurable console logging levels.
warnings:
console: true
console-verbosity: low
Available levels:
| Level | Description |
|---|---|
off | Suppresses routine Anti-Dupe console output |
low | Startup information and confirmed detections/removals |
med | Includes scheduled and manual scan summaries |
high | Diagnostic, testing and administrative information |
Critical recovery failures can still be logged regardless of routine verbosity.
Changing console verbosity does not disable:
- Discord alerts
- Recovery records
- Daily logs
- In-game administrator notifications
This allows large servers to reduce console spam without weakening Anti-Dupe's other reporting systems.
Private Detection Notifications
Regular players do not receive duplicate-detection warnings.
Detection information is restricted to:
- Server Console
- Authorized Administrators
- Daily Log Files
- Discord
Permission:
antidupe.notify
This prevents suspected exploiters from receiving detailed information about the detection system.
Daily Logs
Location:
plugins/Anti-Dupe/logs/
Filename:
anti-dupe-YYYY-MM-DD.log
Logs rotate automatically by date.
Discord Webhook Alerts
Anti-Dupe supports rich Discord webhook notifications.
Configuration:
discord:
enabled: true
webhook-url: ""
username: "Anti-Dupe"
avatar-url: ""
locale: en_US
embed-color: "#FFB000"
include-coordinates: true
role-mention: ""
Detection embeds can contain:
- Player
- UUID
- World
- Coordinates
- Detection Time
- Detection Reason
- Removed Item
- Removed Quantity
- Recovery ID
- Removal confirmation
Webhook delivery runs asynchronously to avoid blocking the main Minecraft server thread.
Discord may use a separate locale from the server's default language.
Console vs Discord Logging
Console verbosity only controls console output.
For example:
warnings:
console-verbosity: off
does not disable:
Discord alerts
Recovery records
Daily logs
Administrator notifications
This separation allows administrators to keep detailed security records while maintaining a clean server console.
Multi-Language Support
Anti-Dupe now provides 28 locale variants.
Supported locales:
| Locale | Language |
|---|---|
🇺🇸 en_US | English |
🇩🇪 de_DE | German |
🇪🇸 es_ES | Spanish |
🇨🇦 fr_CA | French (Canada) |
🇫🇷 fr_FR | French (France) |
🇮🇹 it_IT | Italian |
🇯🇵 ja_JP | Japanese |
🇵🇱 pl_PL | Polish |
🇧🇷 pt_BR | Portuguese (Brazil) |
🇷🇺 ru_RU | Russian |
🇹🇷 tr_TR | Turkish |
✨ uk_UA | Ukrainian |
🇨🇳 zh_CN | Simplified Chinese |
🇰🇷 ko_KR | Korean |
🇳🇱 nl_NL | Dutch |
🇨🇿 cs_CZ | Czech |
🇮🇩 id_ID | Indonesian |
🇹🇼 zh_TW | Traditional Chinese (Taiwan) |
🇸🇪 sv_SE | Swedish |
🇳🇴 no_NO | Norwegian |
🇩🇰 da_DK | Danish |
🇫🇮 fi_FI | Finnish |
🇷🇴 ro_RO | Romanian |
🇭🇺 hu_HU | Hungarian |
🇬🇷 el_GR | Greek |
🇸🇦 ar_SA | Arabic |
🇮🇱 he_IL | Hebrew (Israel) |
🇮🇳 hi_IN | Hindi (India) |
Configuration:
language:
default: en_US
use-client-locale: true
Language files:
plugins/Anti-Dupe/lang/
When client-locale support is enabled, Anti-Dupe can use the player's supported locale where appropriate.
Unsupported client locales can fall back to the configured default language.
New Languages Added
Anti-Dupe's international support has been substantially expanded.
The following locales were added:
- 🇰🇷
ko_KR— Korean - 🇳🇱
nl_NL— Dutch - 🇨🇿
cs_CZ— Czech - 🇮🇩
id_ID— Indonesian - 🇹🇼
zh_TW— Traditional Chinese (Taiwan) - 🇸🇪
sv_SE— Swedish - 🇳🇴
no_NO— Norwegian - 🇩🇰
da_DK— Danish - 🇫🇮
fi_FI— Finnish - 🇷🇴
ro_RO— Romanian - 🇭🇺
hu_HU— Hungarian - 🇬🇷
el_GR— Greek - 🇸🇦
ar_SA— Arabic - 🇮🇱
he_IL— Hebrew (Israel) - 🇮🇳
hi_IN— Hindi (India)
This expands Anti-Dupe well beyond its original language set and makes administration easier for international server communities.
Administrator README
Anti-Dupe includes administrator documentation with the plugin resources.
The README provides local reference information for:
- Security configuration
- OP protection
- Creative protection
- Trusted plugins
- Recovery
- Inventory rollback
- Deep scanning
- Console verbosity
- Testing
- Bundle handling
Localized README files can also be provided alongside supported language resources.
bStats Metrics
Anti-Dupe includes support for bStats anonymous plugin metrics.
Metrics are intended to provide general usage information useful for understanding Anti-Dupe adoption and compatibility.
Metrics should never be used as part of duplicate enforcement.
Server administrators can control bStats through the normal bStats configuration system.
Permissions
antidupe.admin
antidupe.notify
antidupe.whitelist
antidupe.recovery
antidupe.dupe
antidupe.bypass
antidupe.security
Individual installations may expose additional permissions for specific administrative functionality.
Recommended Deployment
For a new installation, begin in:
mode: AUDIT
Before enabling automatic quarantine, test normal server activity extensively.
Test:
- Crafting
- Player crafting
- Furnaces
- Blast Furnaces
- Smokers
- Smithing
- Anvils
- Grindstones
- Brewing
- Villager Trading
- Shops
- Trusted plugins
- Hoppers
- Ender Chests
- Chests
- Barrels
- Shulker Boxes
- Bundles
- Stack Splitting
- Stack Merging
- Item Pickup
- Item Drop
- Elytra flight
- High-speed Nether travel
- Portals
- Teleports
- Chunk loading
- Modded/custom containers
- Proxy/server transfers where applicable
Administrators should also test:
/dupe
to verify intentional duplicate detection.
After normal gameplay has been validated:
mode: QUARANTINE
Quarantine Workflow
When Anti-Dupe confirms an unauthorized duplicate:
Suspicious item detected
↓
Verify transaction
↓
Confirm duplicate
↓
Preserve original
↓
Backup duplicate
↓
Create recovery record
↓
Remove duplicate
↓
Update logs
↓
Notify administrators
↓
Send Discord alert
The administrator can then review the incident and restore the item if the detection was a false positive.
False Positive Protection Philosophy
Anti-Dupe is designed around the principle that:
Detection confidence is more important than immediately deleting a suspicious item.
Where possible, Anti-Dupe attempts to distinguish:
Item movement
from:
Item creation
and:
Temporary inventory state
from:
Persistent duplicate state
Systems such as:
- Transaction grace periods
- Trusted transactions
- Cursor accounting
- Crafting transaction handling
- Bundle accounting
- Movement stabilization
- Cross-inventory confirmation
- Recovery backups
- Inventory rollbacks
exist specifically to reduce the risk of legitimate items being permanently lost.
!ads
