🔒 UPDATE 4.0.2 Security Hotfix
CocoVaults Premium - Released February 16th, 2026
⚠️ CRITICAL SECURITY UPDATE
This update patches multiple item duplication exploits and data integrity vulnerabilities.
All servers should update immediately.
🔒 Critical Security Fixes
• MySQL/MariaDB Dupe Exploit Fixed - Fixed critical bug where emptying a vault would not save, causing old items to reload from database (infinite item duplication)
• Race Condition Dupe Fixed - Fixed race condition where delayed click tasks could overwrite vault saves on close, causing item duplication or loss
• Cross-Server Duplication Fixed - Added missing cross-server validation checks to prevent simultaneous vault access across multiple servers
• Blacklist Save Failure Exploit Fixed - Blacklisted items are now only returned to players after successful save, preventing duplication on save failures
✨ Data Integrity Improvements
• Thread-Safe Vault Data - VaultData now uses proper synchronization to prevent corruption from concurrent access
• Thread-Safe Active Vaults - Fixed non-thread-safe ArrayList causing potential crashes in ACTIVE_VAULTS registry
• Async Save Performance - Vault close saves are now fully async, eliminating main thread blocking during slow database operations
• Cross-Server Cache Invalidation - Vault cache is properly invalidated on cross-server opens to ensure fresh data is loaded
• Heartbeat Synchronization - markPlayerOffline now properly awaits completion, preventing cross-server race conditions
🛠️ Additional Fixes
• Single-Server Memory Leak Fixed - Player quit now properly flushes pending saves and clears cache in single-server mode
• Event Priority Corrected - InventoryCloseEvent changed from MONITOR to HIGH priority to properly handle state modifications
• Debounced Save Race Fixed - Fixed race condition where async removal could delete newly scheduled saves
• Click Task Leak Fixed - Pending click/drag delayed tasks are now properly cancelled when vaults close
⚠️ Important Changes
• Breaking Behavior Change - Empty vaults are now saved to database (previously skipped in MySQL/MariaDB only)
• PlayerChangeServerListener - Now always registered and handles both single-server and cross-server modes
• Config Reload Support - Cross-server protection now works correctly when enabled via /cv admin reload
📋 Update Instructions
1. BACKUP YOUR DATABASE - Always backup before updating
2. Stop your server
3. Replace the old CocoVaults.jar with version 4.0.2
4. Start your server
5. Monitor console for any errors during startup
⚠️ Critical Notes
• UPDATE IMMEDIATELY - Multiple critical duplication exploits have been patched
• All empty vaults will now be saved to the database (fixing the dupe exploit)
• Cross-server setups will see improved data consistency
• Single-server setups will have better memory management
• No configuration changes required
• Fully compatible with existing vault data
🔍 Technical Details
For server administrators interested in the technical details:
• 12 distinct vulnerabilities patched in this release
• 5 critical severity issues resolved
• Thread safety improvements across 3 core classes
• Cross-server sync logic completely redesigned
• All changes are Java 8 compatible