Bukkit

The problem

For those who aren't in the know, the minecart spam exploit is exactly what it says on the tin: spam enough minecarts in a small space and the server's performance tanks. The Horizon recently demonstrated this exploit in a video of his:

While this exploit alone is quite bad, as it turns out Crackshot amplifies the effects of this exploit exponentially, making it far easier to crash a server with the plugin running it. From what I've noticed from a server I administrate on, Crackshot reduces the number of minecarts needed from ~5K to around a thousand at most.

If you are seeing messages like this in your logs when your server crashes with the plugin enabled, chances are someone crashed it by spamming minecarts:

[16:05:40] [Paper Watchdog Thread/ERROR]: ------------------------------
[16:05:40] [Paper Watchdog Thread/ERROR]: Current Thread: Server thread
[16:05:40] [Paper Watchdog Thread/ERROR]: PID: 22 | Suspended: false | Native: false | State: RUNNABLE
[16:05:40] [Paper Watchdog Thread/ERROR]: Stack:
[16:05:40] [Paper Watchdog Thread/ERROR]: CrackShot.jar//com.shampaggon.crackshot.CSMinion.reseatTag(CSMinion.java:820)
[16:05:40] [Paper Watchdog Thread/ERROR]: CrackShot.jar//com.shampaggon.crackshot.CSDirector.onBoatMine(CSDirector.java:4238)
[16:05:40] [Paper Watchdog Thread/ERROR]: com.destroystokyo.paper.event.executor.asm.generated.GeneratedEventExecutor128.execute(Unknown Source)
[16:05:40] [Paper Watchdog Thread/ERROR]: app//org.bukkit.plugin.EventExecutor.lambda$create$1(EventExecutor.java:69)
[16:05:40] [Paper Watchdog Thread/ERROR]: app//org.bukkit.plugin.EventExecutor$$Lambda$5252/0x0000000801baceb8.execute(Unknown Source)
[16:05:40] [Paper Watchdog Thread/ERROR]: app//co.aikar.timings.TimedEventExecutor.execute(TimedEventExecutor.java:80)
[16:05:40] [Paper Watchdog Thread/ERROR]: app//org.bukkit.plugin.RegisteredListener.callEvent(RegisteredListener.java:70)
[16:05:40] [Paper Watchdog Thread/ERROR]: app//org.bukkit.plugin.SimplePluginManager.callEvent(SimplePluginManager.java:628)
[16:05:40] [Paper Watchdog Thread/ERROR]: app//net.minecraft.world.entity.vehicle.AbstractMinecart.push(AbstractMinecart.java:841)
[16:05:40] [Paper Watchdog Thread/ERROR]: app//net.minecraft.world.entity.vehicle.AbstractMinecart.tick(AbstractMinecart.java:472)
[16:05:40] [Paper Watchdog Thread/ERROR]: app//net.minecraft.server.level.ServerLevel.tickNonPassenger(ServerLevel.java:1120)
[16:05:40] [Paper Watchdog Thread/ERROR]: app//net.minecraft.server.level.WorldServer$$Lambda$7187/0x00000008023db378.accept(Unknown Source)
[16:05:40] [Paper Watchdog Thread/ERROR]: app//net.minecraft.world.level.Level.guardEntityTick(Level.java:977)
[16:05:40] [Paper Watchdog Thread/ERROR]: app//net.minecraft.server.level.ServerLevel.lambda$tick$7(ServerLevel.java:775)
[16:05:40] [Paper Watchdog Thread/ERROR]: app//net.minecraft.server.level.WorldServer$$Lambda$7113/0x00000008023b0c20.accept(Unknown Source)
[16:05:40] [Paper Watchdog Thread/ERROR]: app//net.minecraft.world.level.entity.EntityTickList.forEach(EntityTickList.java:43)
[16:05:40] [Paper Watchdog Thread/ERROR]: app//net.minecraft.server.level.ServerLevel.tick(ServerLevel.java:756)
[16:05:40] [Paper Watchdog Thread/ERROR]: app//net.minecraft.server.MinecraftServer.tickChildren(MinecraftServer.java:1627)
[16:05:40] [Paper Watchdog Thread/ERROR]: app//net.minecraft.server.dedicated.DedicatedServer.tickChildren(DedicatedServer.java:490)
[16:05:40] [Paper Watchdog Thread/ERROR]: app//net.minecraft.server.MinecraftServer.tickServer(MinecraftServer.java:1483)
[16:05:40] [Paper Watchdog Thread/ERROR]: app//net.minecraft.server.MinecraftServer.runServer(MinecraftServer.java:1282)
[16:05:40] [Paper Watchdog Thread/ERROR]: app//net.minecraft.server.MinecraftServer.lambda$spin$0(MinecraftServer.java:319)
[16:05:40] [Paper Watchdog Thread/ERROR]: app//net.minecraft.server.MinecraftServer$$Lambda$3668/0x000000080140ec80.run(Unknown Source)
[16:05:40] [Paper Watchdog Thread/ERROR]: [email protected]/java.lang.Thread.run(Thread.java:833)
[16:05:40] [Paper Watchdog Thread/ERROR]: ------------------------------
[16:05:40] [Paper Watchdog Thread/ERROR]: --- DO NOT REPORT THIS TO PAPER - THIS IS NOT A BUG OR A CRASH ---
[16:05:40] [Paper Watchdog Thread/ERROR]: ------------------------------

The mitigation

Completely remove the plugin for now. Unfortunately, there is no way to disable the portion of this plugin that amplifies the exploit without disabling the entire plugin. While this won't necessarily stop the exploit from crashing your server, it'll definitely give you more legroom to work with when it comes to finding out what is lagging your server and it will make your server less prone to crashes caused by this exploit.