Skip to content

[CRITICAL] Inventory Duplication Exploit via Off-Hand during Duels #315

Description

@lnrdbllcc-arch

Server version

1.21.10

Duels version

7.2

Plugin list

.

Describe the bug

Hello, I would like to report a bug regarding inventory management during duels.

Currently, if a player starts a duel holding an item in their off-hand and moves it into their main inventory during the match, the item gets duplicated once the duel ends. So far, we have only encountered the issue through this specific method, but I cannot rule out the possibility of other variations of the same bug.

Below is the video proof demonstrating the issue: https://youtu.be/iauxHDgEmXs

Expected behavior

The expected behavior should involve a full rollback of the inventory to its initial state. Upon entering a duel, any action performed on the items (moving, dropping, breaking them, etc.) should not affect the external inventory. Once the match is over, the player's inventory should return exactly to how it was at the moment of entry, thus preventing both item loss and potential duplication exploits. Obviously, I will leave the technical details to you, but I wanted to emphasize this because a dupe bug is extremely severe for the game economy.

Steps to reproduce

Step 1: Start the duel using your own inventory while holding an item in your off-hand. (Note: For now, we have only encountered the issue with this specific method, but there might be others).

Step 2: During the duel, move the item from your off-hand into your main inventory.

Step 3: Finish the duel (either by winning, losing, or leaving).

Step 4: Once you return to the main world, the item will be duplicated: it will appear both in the inventory slot where it was moved and back in your off-hand.

Additional info

No response

Checklist

  • I am running latest version of the plugin
  • I have read the wiki to make sure it's not an issue with configuration
  • I ticked all of the boxes without actually reading them
  • I have read the Compatibility wiki page and am not trying to run the plugin on an unsupported server version / platform
  • I am willing to cooperate to get this issue resolved faster, including providing any additional information requested or testing new builds

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type: BugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions