Elytrium / Elytrium/LimboFilter

[BUG] Geyser/Floodgate players cannot complete AntiBot checks

Open
#127 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
172
Forks
52
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**

When using LimboFilter together with Geyser and Floodgate on a Velocity proxy, Bedrock players are unable to complete the AntiBot verification.

There are two issues:

1. **Falling Check**
- Bedrock players always fail the Falling Check and are kicked with:
> Falling check failed. Reconnect to the server.
- This happens every time, even though LimboFilter correctly detects the client as Geyser.

2. **Captcha**
- If `geyser-check-state` is changed to `ONLY_CAPTCHA`, the player enters the Limbo world successfully.
- The player receives the dye item, but the captcha map is never rendered.
- The player only sees the void, making the captcha impossible to solve.

From the logs it appears LimboFilter correctly identifies the client:

```text
[limbofilter]: [connected player] .PlayerName (...) has client brand Geyser
```

However, neither the Falling Check nor the captcha works correctly for Bedrock players.

---

**To Reproduce**

1. Install Velocity.
2. Install LimboFilter 1.1.19.
3. Install Geyser-Velocity Build #1205.
4. Install Floodgate-Velocity.
5. Connect using Minecraft Bedrock.
6. Set:
```yaml
geyser-check-state: ONLY_POSITION
```
or
```yaml
geyser-check-state: CAPTCHA_POSITION
```
7. Observe that the player always fails the Falling Check.
8. Change:
```yaml
geyser-check-state: ONLY_CAPTCHA
```
9. Reconnect from Bedrock.
10. Observe that the captcha map is never displayed (only the dye item is received).

---

**Expected behavior**

For Bedrock (Geyser) players:

- Falling Check should work correctly, **or** be skipped if unsupported.
- Captcha maps should be rendered correctly so the player can solve them.
- Alternatively, if `geyser-bypass` is enabled, Geyser players should bypass AntiBot verification as documented.

---

**Screenshots**

Bedrock client after joining the Limbo world:

- The player spawns in the void.
- The dye item is present.
- The captcha map is never displayed.

Image
Image

---

**Server Info (please complete the following information):**

- All Limbo plugins versions:
- LimboAPI (latest bundled with LimboFilter 1.1.19)
- LimboFilter 1.1.19
- LimboAuth (latest release)

- Other relevant plugins:
- Velocity 4.1.0-SNAPSHOT
- Geyser-Velocity Build #1205
- Floodgate-Velocity (latest build)

- Backend:
- Purpur

- Bedrock client:
- Latest Bedrock version (currently 1.21.120)

- /velocity dump link:
- (Will provide if required.)

---

**Additional context**

I also noticed that:

```yaml
filter-auto-toggle:
geyser-bypass: 0
```

does not appear to bypass AntiBot checks for Geyser players.

LimboFilter correctly detects the client as Geyser:

```text
[limbofilter]: [connected player] .PlayerName (...) has client brand Geyser
```

but still performs the Falling Check, which always fails.

Additionally, when using `ONLY_CAPTCHA`, the captcha map is never rendered on the Bedrock client, making it impossible to complete the verification.

This makes it currently impossible for Bedrock players using Geyser/Floodgate to pass LimboFilter's AntiBot verification.

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the issue with the listed Velocity, Geyser, Floodgate, LimboFilter, and Bedrock versions using each geyser-check-state and filter-auto-toggle.geyser-bypass setting. Trace the AntiBot behavior for Geyser clients through the Falling Check and captcha paths. Done means Bedrock players can pass supported checks, see the captcha map, or reliably bypass verification when configured.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.