Item-duplication audit: bank, drop/pickup, equip, death-drop, Make-X #46

New issue

Closed

opened 2026-06-11 14:06:24 +00:00 by sickday · 0 comments

sickday commented

2026-06-11 14:06:24 +00:00

Owner

Problem

Trade is dupe-hardened (journal, deterministic completer, offer-time removal). The other classic RS dupe vectors have not been audited:

Bank deposit / withdraw (incl. withdraw-X, withdraw-all)
Drop / pickup (ground items, ownership + timers)
Equip / unequip (slot swap, stack merge)
Death-drop (item ordering, protect-item, gravestone)
Make-X skilling flows (mid-action inventory changes)

Task

Trace each surface for: item created without removal, removal without creation, race between two actions on the same slot, and inventory-full edge cases. Add property/regression tests where dupes are plausible.

Acceptance

Each surface has a documented dupe-safety argument + a test for the risky path.

Part of the Security & Data-Integrity Hardening epic.

## Problem Trade is dupe-hardened (journal, deterministic completer, offer-time removal). The other classic RS dupe vectors have **not** been audited: - Bank deposit / withdraw (incl. withdraw-X, withdraw-all) - Drop / pickup (ground items, ownership + timers) - Equip / unequip (slot swap, stack merge) - Death-drop (item ordering, protect-item, gravestone) - Make-X skilling flows (mid-action inventory changes) ## Task Trace each surface for: item created without removal, removal without creation, race between two actions on the same slot, and inventory-full edge cases. Add property/regression tests where dupes are plausible. ## Acceptance - Each surface has a documented dupe-safety argument + a test for the risky path. Part of the Security & Data-Integrity Hardening epic.

sickday referenced this issue

2026-06-11 14:06:43 +00:00

Epic: Security & Data-Integrity Hardening #50

sickday added the

bug

epic:security-hardening

priority:medium

server

labels

2026-06-11 14:07:37 +00:00

sickday added this to the v1 milestone

2026-06-11 14:11:16 +00:00