Dupes and exploits: closing them on a Minecraft server

In short: on Paper, TNT, carpet and rail duping, sand duping through End portals and bedrock breaking are off by default — don't turn them on in unsupported-settings without a deliberate decision. Keep the server and plugins updated: new dupes get fixed in new builds. Leave Paper's packet and book limits at their defaults, keep CoreProtect logs to find a duper, and ban dupes and bug abuse in your rules.

Dupe, exploit and cheat: the difference#

The Minecraft Wiki notes that Mojang tries to remove duping in Survival in almost every update, and that on many servers duping items is a bannable offence. The exception is TNT duping: after several fixes it was ultimately allowed in the vanilla game.

What Paper fixes by default#

Paper fixes many vanilla bugs — the most prevalent, per its docs, are TNT duplication and bedrock breaking. The rule: if a bug is confirmed on Mojang's tracker and has a priority assigned, Paper accepts a fix without waiting for Mojang. If Mojang declined the report, it's intended behaviour and Paper leaves it alone. Some fixes can be turned off in the unsupported-settings section of config/paper-global.yml:

In the same file, update-equipment-on-player-actions: true (the default) stops players from exploiting attributes by switching equipment right before using it, and oversized-item-component-sanitizer.dont-sanitize: [] keeps the protection against oversized items — changing it, per the docs, re-enables exploits.

Fixes in the world settings#

Packet and book exploits#

Some exploits aren't about game mechanics at all: the client sends a flood of packets or an item with huge data to hang the server or bloat chunk and player data. paper-global.yml has limits for that — keep them on:

• `packet-limiter`. By default 500 packets per 7 seconds per player, then a kick (KICK); you can instead drop the excess (DROP) and set limits for individual packets.
• `spam-limiter`. Kicks for tab-completion spam (tab-spam-limit: 500) and recipe spam (recipe-spam-limit: 20).
• `item-validation.book`. A book page up to 16384 characters, title and author up to 8192. Together with book-size (page-max: 2560 bytes per page, total-multiplier: 0.98) it caps a book's total weight.
• `item-validation.resolve-selectors-in-books: false`. Per the docs, with true players in creative mode get yet another way to crash the server.

Books can be a weapon even without an exploit: a bot writes them by the hundred, and chests of heavy books bloat the world's save data — that's BookBot. The impossible packets that exploits are built on are covered in BadPackets.

Updates are the main defence#

New dupes are found all the time, and they're fixed in new builds of the server software and plugins. PaperMC recommends updating Paper at least once a week — with a backup, and never replacing a jar on a running server. If a dupe involves a plugin, update it and tell the author; until there's a fix, disable the plugin or the feature. Moving to a new game version is covered in updating the server.

How to find a duper#

1. 1

   Spot the anomaly

   A sudden surge of valuable items in the economy, a player with chests of identical items, TPS complaints near someone's base.

2. 2

   Check CoreProtect

   a:+container and a:-container — what the player put in and took out of chests, a:inventory and a:item — what went into their inventory, #count — how many rows. Commands are in CoreProtect.

3. 3

   Reproduce it on a copy

   Not on the live server: restore a copy from a backup, repeat the steps and see whether items duplicate.

4. 4

   Close it and update

   Update the server or the plugin, disable the mechanic or the setting. Report the exploit to the developers, not in public chat.

5. 5

   Clean up

   Remove the duped items, roll back with CoreProtect where you can, and punish according to the rules.

/co lookup u:Steve t:1d a:+container i:diamond_block,netherite_ingot
/co lookup u:Steve t:1d a:+item #count

A punishment for duping only works if it's written down: "using bugs and dupes is forbidden; report any you find to the staff". How to word it is in server rules.

Where the anticheat comes in#

An anticheat won't fix a bug in the server's code — that's the job of the server software and its updates. But many exploits give themselves away with packets an honest client never sends: a head pitch beyond 90°, a slot outside the hotbar, a click on a window slot that doesn't exist, a stream of books. DGuard — the best anticheat for a modern Minecraft server — checks those packets: BadPackets, packet order within a tick, and BookBot. In our comparison only DGuard has a full BookBot check.

The checks run in network threads — 0.03 % of one core on the main thread — and a punishment rests on accumulated evidence, not one odd packet: players join from different versions through ViaVersion, and a rule has to know what's normal for them. Every ban comes with a report you can match against CoreProtect's logs.

FAQ#