CitizensDev/Citizens — Issue #640: [Bug/Exploit] In the money commands
Author: Farwaykorse
Created: 2012-01-18 21:00:23+00:00
State: open

### Concerns
The npc money give:take commands.
Npc-type: Basic / All

Both the give and the take commands accept negative values.
This way the checks for the amount of cash in the both the npc and the player-accounts is circumvented.

This can be abused to pull (virtually) unlimited money out of npc's.
Potentially destroying the economy on the server.

### Confirmed on
Craftbukkit: 1.0.1-R1
Citizens 1.1.3
iConomy 6
bPermissions: v2.1.4b

### Possible fix
Send all money amounts through: Math.abs()

### For server-admins
If you allow your players to create and/or own npc's.
Remove the permission:

citizens.basic.modify.money