Skip to content

[Exploit / Security] Remote emptying of Shop structures / Marketplace items ("Item Rain") #135

Description

@ZekuOfficial

Describe your idea

Occurred under version v1.8.3 (prior to the 1.9.0 update): A cheater was able to empty items from player-built Shop / Marketplace structures owned by other players, triggering all items inside to drop.

This resulted in an "item rain" effect, where the emptied items floated and spawned in the air above a neighboring base nearby.

Purposes

To prevent remote theft and item loss from player shops. While PalDefender successfully blocks unauthorized access to regular storage chests, Shop / Marketplace structures seem to lack proper RPC validation or permission checks for dropping/emptying inventory contents remotely.

Expected Behavior

Review interaction and RPC validation for Shop / Marketplace objects to ensure that items inside shop structures cannot be emptied or dropped remotely without proper access permissions.

Attachments

No response

Priority

Low

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions