The Tax Bug: How We Accidentally Taxed Every Shop Transaction

We owe you an apology — and an explanation.

For 11 days (February 18 through March 1), every purchase at a player shop on Mooshroomia was silently taxed at 5%. Nobody was told. Nobody could see it happening. And the money didn't even go anywhere useful — it was destroyed.

What Happened

When QuickShop-Hikari was installed, we never changed its default tax settings. Buried in the config was this:

shop-tax:
  type: basic
  account: tax
  show: false
  apply-to: player
  basic:
    rate: 0.05

That's a 5% tax on the buyer of every shop transaction, with show: false meaning no one could see it was happening. The tax was sent to a fake account called "tax" that didn't actually exist in the economy — so the money simply vanished.

On a server whose entire philosophy is no taxation, no admin interference, no handouts — this is about as bad as it gets.

How It Was Found

During a config review on March 1st. PizzaJon had also noticed something was off — having ~$64,600 wasn't enough to buy 64 shulker shells priced at $1,000 each. That's because the real cost was $1,050 per shell after the hidden tax.

The Damage

We queried QuickShop's internal database and found 68 taxed transactions across 10 players, totaling $38,715.94 stolen from the economy.

Player Tax Paid
AnemoneFlynn $17,058.75
Lechnio $11,670.80
PizzaJon $3,200.25
Conisious $2,057.55
Talrinion $1,808.01
Cardano_ff $1,710.00
Aewheros $504.30
Sky2GG $321.42
fr0zenhammerz $230.00
sharonclaws $154.86

The tax was charged to buyers only. Sellers received their full advertised prices and were not affected.

The Fix

  1. Tax rate set to 0 in the QuickShop config
  2. Emergency server restart (with fair warning)
  3. Every affected player refunded to the exact cent via /eco give
  4. All refunds verified against before/after balances

Never Again

This was a default config value that should have been reviewed on install. We've documented the incident and the process for auditing QuickShop's transaction database so this kind of thing can be caught and quantified quickly if it ever happens again.

If you were affected and have any questions, reach out in-game or on Discord.

← Back to blog