Minecraft server security

Nothing gets through

nullwall builds the defences behind a Minecraft server. First up is Citadel: an anticheat that checks movement against a physics simulation, backs it with heuristics for everything physics can't prove, and lets you watch a conviction back as a replay, in game.

Meet Citadel See how it works

Project 01

Citadel

An anticheat for Paper and Folia built on two kinds of check. A simulation tier replays the game's movement physics and measures how far each player strays from it; a heuristic tier covers what physics can't prove, like aim, click timing and packet order. Every firing feeds one fused threat score, so no single check convicts on a hunch.

Dashboard coming soon at citadel.nullwall.dev

108
checks
25 / 83
simulation / heuristic
15
evidence families fused into one threat score
~30s
kept per player by the flight recorder
where the client said it was where the simulation says it could be footprints, coloured by speed

  • Simulation tier

    25 checks compare each movement against a model of vanilla physics: gravity, air drag, fluids, ladders, cobwebs, elytra, vehicles, levitation and knockback, plus reach and hitbox. A flag here means the claimed position and the simulated one were further apart than the allowance.

  • Heuristic tier

    83 checks for what physics can't prove: aim and rotation patterns, click timing, packet order and timer abuse, scaffolding, inventory and chest-stealing, and client brands and mod channels. 14 newer checks run report-only, so they alert without punishing.

  • Fused verdicts

    Firings are grouped into 15 evidence families and fused into one threat score, so three checks reacting to the same swing count once. A conviction is armed, then carried out 2 to 8 ticks later at random, and dropped if the evidence has faded by then.

  • Latency-aware

    Ping and pong transactions measure each player's real round trip, and knockback is sandwiched between two of them. Reach rewinds the target to where that client last saw it, against each entity's vanilla hitbox, and suspicion drains faster on a jittery connection.

  • Flight recorder

    About thirty seconds of every player is kept in memory. On a conviction, or when staff run /citadel clip, the run-up is saved as a clip with its terrain and entities, and a fight nearby is merged into one clip with everyone in it.

  • In-game replay theatre

    Clips play back as ghosts, terrain and holograms drawn only for the viewer. Step frame by frame, look through their eyes, see the predicted ghost beside the claimed one, browse clips by player, and invite another moderator to watch along.

  • Bedrock and older clients

    Geyser and Floodgate players get Bedrock-specific prediction for analogue sticks, jumping and knockback. Clients before 1.9 and 1.14 are judged by their own rules, such as no attack cooldown and their own sneaking eye height.

  • Built for Folia

    Each player's packets are checked in order on their own virtual thread, away from the network and region threads. Under overload, movement packets are dropped and prediction restarts clean, so nobody is judged on half a picture.

  • Tested against real play

    Every build replays a library of recorded legit and cheating clips through the engine. A legit clip that starts to flag, or a cheat that stops flagging, fails the build.

How it works

From packet to proof

A conviction can be traced back to the packets that caused it, and played back for anyone who asks why.

  1. 01

    Capture

    The packets the checks need, in both directions, with a copy of the world and entities as that player's client was told about them.

  2. 02

    Check

    The simulation tier predicts where the player could legally be; the heuristic tier looks at aim, timing and packet order. Both account for ping, gear and effects.

  3. 03

    Fuse

    Firings become one threat score across evidence families. Conviction waits a random few ticks and is dropped if the evidence fades.

  4. 04

    Record

    A conviction saves the flight recorder's last seconds as a clip, with the blocks and entities in it.

  5. 05

    Replay

    Staff watch it back in game, with the claimed and predicted ghosts side by side, and decide for themselves.

About

Why nullwall

A good wall is one nobody notices until something hits it. nullwall makes server-side tooling in that spirit: quiet when players are playing fairly, and clear about what happened when they aren't.

Citadel is the first project. A dashboard for managing it will live at citadel.nullwall.dev.

Follow on GitHub