EconGuard

A shared economy audit ledger and anti-abuse / RMT-detection core for Paper.

EconGuard doesn't move money and has no player-facing features. It's the piece your other economy plugins report to — one unified ledger, one place to investigate, one audit trail for a ban or rollback. RoyalBank, RoyalAuctions, and RoyalBazaar all report to it automatically, and its public API lets any plugin do the same.

The problem it solves

Every economy plugin grows its own half-blind anti-abuse layer. The bank sees deposits, the auction house sees sales, the shop sees purchases — and none of them see each other. So the one pattern that actually matters stays invisible to all of them:

A three-day-old account receives 500M through an auction "sale" of a dirt block, immediately banks it, and withdraws it over the next week.

The auction house sees a weird sale. The bank sees a big deposit. Neither sees RMT. EconGuard does — because every plugin reports into one ledger, and detection runs across sources, not within a single one.

Detection signals

EconGuard runs four signals over the unified ledger:

• Large transaction — logs any unusually large single movement (informational).
• Young incoming transfer — flags a new account receiving a large lump sum in one go.
• Velocity — flags a new account gaining wealth abnormally fast within a rolling window.
• Counterparty correlation — flags the same payer repeatedly funding the same receiver across different channels (bank, auction, pay). This is the one that catches RMT rings, and the one a per-plugin detector structurally cannot replicate.

The young-account gate is the core idea. Two of the signals only fire on new accounts — because wealth arriving with no time invested is the real RMT fingerprint, while a veteran selling a lucky drop is not suspicious. Flagging the veteran is exactly how an anti-abuse system trains staff to ignore it.

Flags, not punishments

EconGuard surfaces abuse; it never auto-punishes. The in-game half of an RMT deal looks identical to a legitimate gift, so nothing on your server can block it with certainty. A false ban costs far more than a missed flag — so EconGuard flags for a human to review and leaves the decision to you.

Alerts and flags surface to the console, to online staff with the econguard.alerts permission, and to an optional Discord webhook.

Reviewing a suspect

A single command surface for investigation, instead of cross-referencing each plugin's separate logs:

/eg history is where you see the chain — value arriving via an auction sale, then leaving via a bank withdrawal — that no single plugin could show you.

Tuning

The default thresholds are deliberately high, sized for a large-currency-supply server, and on a smaller economy they may never fire. Calibrate them against your own numbers, run for a week, then read /eg flags. A detector that flags twenty accounts a day gets ignored — fewer, higher-confidence flags are the goal.

To actually cap the damage of RMT (rather than just detect it), pair EconGuard with a currency maximum and friction — limits, cooldowns, or tax — on player-to-player transfers.

For the whole suite

Install EconGuard once and every Royal* plugin feeds it — no configuration required on either side:

Each of those plugins runs perfectly well without EconGuard — the integration is a single optional lookup, so nothing breaks when it's absent. With it installed, you get cross-plugin correlation and one audit trail.

For developers

EconGuard exposes a small, generic public API. Reporting a money movement from your own plugin is one statement, and it's a no-op when EconGuard isn't installed — so you don't need a hard dependency:

EconGuard.get().ifPresent(api -> api.record(
    MoneyEvent.builder(player.getUniqueId(), player.getName())
              .source(Sources.SHOP)
              .action("purchase")
              .amount(price)
              .incoming(false)   // money leaving the player
              .build()));

Run a custom shop, a /pay bridge, or a crate/reward plugin? Report those movements too and pull them into the same ledger. The more sources report, the sharper the correlation. Full API reference — the MoneyEvent builder, Sources, Flag, and the two things to get right — is on the wiki.

Storage

SQLite by default, MySQL for a network. SQLite (econguard.db) needs no setup and is ideal for a single server; point it at MySQL instead and every server on your network reports into one shared ledger — which is exactly what makes cross-server correlation possible. Either way the ledger and flag list are bounded by a configurable per-player row cap that's pruned on startup, and writes are asynchronous so they never block gameplay. JDBC drivers are downloaded at runtime by Paper's library loader — nothing is bundled into the jar.

Requirements

• Paper 1.21+ (tested on Paper 26.2)
• No hard dependencies — EconGuard installs and runs on its own (it just has nothing to record until a reporting plugin is present)
• Optional: a Discord webhook for alert mirroring

Installation

1. Drop EconGuard.jar into your plugins/ folder.
2. Start the server — config.yml generates under plugins/EconGuard/.
3. Any suite plugin already installed begins reporting automatically.
4. Tune config.yml to your economy and run /eg reload.

Part of the suite

EconGuard is the audit core for RoyalBank, RoyalAuctions, and RoyalBazaar — but it's optional for all of them, and any plugin can feed it. Full documentation is on the GitHub wiki.