DonutSMP’s Mod Scanner Runs on a Minecraft Bug Mojang Still Hasn’t Fixed

What happened: DonutSMP, one of the busiest public Minecraft servers, detects cheat clients such as Meteor and mods like Freecam with a trick known as the sign translation exploit. Your client is made to open an invisible sign for a split second, and its reply reveals which mods you have installed. Players say the same scanner has banned people over resource packs and harmless client mods, and the hole it relies on is still unpatched in vanilla Minecraft.

Who is affected

Anyone playing Minecraft: Java Edition 1.20 or newer on a server that uses the technique. That includes DonutSMP and the growing number of servers running copycat plugins such as ModDetector, ModCheck and AntiMod. Bedrock Edition players are not affected.

The obvious targets are cheat clients. But the same probe works on any mod that adds its own text, so a server can see harmless performance, map and quality-of-life mods too. It can also read your keybinds and the language your game runs in.

How it works

Minecraft text can contain placeholders: a translation key such as key.freecam.toggle, or a keybind reference. Your game swaps these for real text using your language files and settings, including the files your mods add.

1. As you join, the server places a sign with these placeholders and forces the sign editor open on your screen.
2. The editor closes again before you can see it.
3. Since 1.20, closing the editor converts the sign to plain text and sends it back to the server, with the placeholders already filled in.
4. If the reply says “Toggle Freecam” instead of the raw key, the server knows Freecam is installed. The ban can follow automatically.

Researchers later found the same trick works through anvil renaming. Before 1.20 this text was only ever shown on your own screen, which is why the Wurst team describes the change as a privacy leak that has caused real harm in the wild.

Who is responsible

Mojang owns the bug. MC-265322 has been public since the 1.20 era, and as of November 2026 the Wurst wiki still lists no official fix. Every Java player depends on Mojang closing it.

DonutSMP chose to build its anti-cheat on that leak rather than on gameplay checks alone. Catching cheaters is a fair goal on a competitive server. Quietly reading the contents of players’ clients, with automatic bans and no clear list of what is forbidden, is a much bigger step, and every false positive lands on a real player.

Cheat client makers are in an arms race with it. Meteor Client tried to block the probe, and its fix was itself detectable, because it sent back the raw key instead of the expected fallback text.

What they say

We found no public technical statement from DonutSMP about the scanner, its list of detected mods, or how it handles false positives. Player reviews describe bans being reversed after support tickets, which suggests appeals do work in at least some cases. Mojang has not commented publicly on MC-265322. If either responds, we will report it.

DonutSMP’s other 2026 controversies

The mod scanner wasn’t the only fight between DonutSMP and its players this year.

• The botting ban wave (April): dozens of players on r/DonutSMP reported permanent “botting” bans for idling in the server’s own AFK areas or using approved mods. One player said they lost two accounts worth about 250 million in-game money. Appeals stretched for days, while players said real cheaters kept raiding bases. The reports are players’ accounts. DonutSMP hasn’t published how its detection works.
• The pay-to-win turn (August): a shard shop selling direct progression boosts and spawners, weaker mob spawners and new anti-AFK and spy systems led critics to call it the beginning of the end for the server’s grind-based economy.
• Fake cheat sites (October): a site posing as a DonutSMP cheat hub spread SilentNet malware to players looking for an edge. See our mod malware guide.

What you should do now

1. Know that any Java server can see your mods. If a server bans a mod, assume it can detect it, and remove it before joining.
2. Check the server’s rules for allowed mods and keep a separate, minimal mod profile for strict servers.
3. Be careful with resource packs that bundle mod language files. They can make you look like you have a mod installed.
4. If you are falsely banned, appeal with specifics: your mod list, your resource packs and the time of the ban.
5. Privacy mods exist. Fabric mods such as ExploitPreventer and OpSec stop your client resolving these placeholders. Some servers treat “protected” clients as suspicious, so read the rules first.
6. Upvote MC-265322 on Mojang’s bug tracker. A vanilla fix protects every player, not just modders.

More server security coverage: Security & Exploits and everything on DonutSMP.