Item integrity and exploit hardening

The problem

On a roleplay server, items are the economy. A bug that loses an item costs a player hours of play, and a bug that duplicates one devalues everyone else’s. I owned the item layer end to end: moving player storage to a new model without losing anything, and closing the gaps players had found.

Migrating every trunk without losing an item

Each vehicle used to have its own trunk. They were replaced by one shared trunk per character, migrated automatically the first time each character loads after the update.

• Items move one at a time, in sequence, so no two transfers ever race each other.
• If the shared trunk is full, the item goes to a lost-and-found inventory at the car dealer instead of failing.
• If a move fails, the item goes back to its original slot. If even that fails, the server raises an error naming the item.
• The vehicle’s database row only switches to the shared trunk after every item has moved, so a failure halfway through leaves the old trunk as the source of truth.
• Every step is written to a dated migration log.

The trade-off

Removing an item and adding it elsewhere isn’t one database transaction, so a server crash between the two steps could still lose that one item. The revert path and the migration log keep that window small and visible, and it was an acceptable risk for a one-time migration.

Equipment that can’t get lost

Equipping clothing moves an item out of the inventory grid into a hidden state. When something went wrong mid-way, items vanished. I rebuilt equipping and unequipping as one promise-based API used by every item type, and added a check on character load that finds items stuck in that hidden state, puts them back, and tells the player what happened.

Closing duplication and teleport exploits

• Shipment duplication. Taking an item from a crate started an asynchronous add without reserving it first, so fast repeated requests could duplicate items. The count is now reserved and the crate locked before the async work, and refunded if the item doesn’t fit.
• Trunk teleporting. Having two vehicles’ trunks open at once let players move items between them from anywhere. Only one trunk can be open at a time now.
• Ghost items. An admin inventory reset could leave slots marked as occupied by items that no longer existed. The grid is now cleared once every removal has finished.

Inventories that fit on the wire

Large inventories were overflowing network buffers when synced to players. I moved inventory and item sync to encoded, compressed payloads with an explicit length prefix.