How to Stop Item Duplication on a Minecraft Server

A duplication exploit, a dupe, lets a player turn one item into many by exploiting how the game processes pistons, portals, containers or networking. On a survival or economy server a dupe devalues everything players have earned, and the damage can be done in minutes. Most of the defence is not a plugin at all.

Why dupes matter more on some servers

On a small private server, a dupe is a curiosity. On a server with a market, ranks bought with in-game money, or scarce resources, it is an economic attack. The more your server's value depends on scarcity, the more seriously you should treat it.

Start with your server software

Many well-known dupes are fixed in Paper, and Paper keeps toggles for the exploits it patches in an unsupported-settings section of its global configuration. The reference describes them, each defaulting to false:

• allow-piston-duplication controls duplication of TNT, carpets and rails. It does not control sand duplication.
• allow-unsafe-end-portal-teleportation allows exploits related to end portal teleportation, for example sand duplication.
• skip-tripwire-hook-placement-validation allows exploits related to tripwire hook duping.
• allow-permanent-block-break-exploits and allow-headless-pistons relate to breaking blocks that should be permanent, which is a different problem but one that causes grief.

The first thing to check is that none of these has been set to true. People sometimes enable them to make a farm design work, and forget. Open the file and read each line.

Equally important: run a recent build. Fixes for newly found dupes arrive in new builds, and an old build is an open door. Make updating a regular habit, and read the changelog for exploit fixes.

Be careful with farms that need an unsafe setting

If a technical player asks you to enable one of these settings, understand what it permits. Enabling it for everyone enables the exploit for everyone. If you want to allow a specific farm design, consider whether the benefit is worth the risk, and disable it again if it is not.

When a dedicated anti-dupe tool helps

A tool can help where your software does not cover a method, or where you run a server type that has no built-in fixes. MCRank lists two Fabric server-side mods built for this, Panda Anti-Dupe and Viper Anti-Dupe. They are mods, so they apply to Fabric servers rather than to Paper. The author of one says it blocks more than twenty-five known methods and lets you choose which to block; read the project's page, because that is the author's claim and not something MCRank has tested.

Whatever you use, test it. Try the common dupes yourself on a copy of your server, using the project's list of what it covers, and remember that no tool covers a method nobody has discovered yet.

Close the loop with logging

If a dupe happens, logs tell you who used it and how much they gained. A block and container log such as CoreProtect records container activity, which helps you find the items and the accounts involved. Turn it on before you need it.

If your economy has already been hit

• Stop the bleeding: disable the exploit, or restrict the feature, as soon as you understand it.
• Find the affected accounts using your logs and any trading or shop plugin records.
• Remove or reverse the items and money gained, preferably with a documented rule you apply to everyone.
• Tell the community what happened and what you did. Silence breeds rumours.
• Consider a single reset of balances if the damage is too wide to repair.

For shops, remember that a plugin such as ChestShop runs through the economy interface, Vault, so a dupe in items becomes a dupe in money as soon as someone sells the copies.

A short policy

Write a rule that using a dupe, or hiding one, is a bannable offence and that reporting one is rewarded. Players who find dupes by accident will report them if they know it is safe to.