Versions
Minecraft Version: 1.19.4
Forge Version: N/A
Fabric Version: 0.14.21
Mod Version: 4.0.0

Describe the bug
The "/ls withdraw" command can be used to withdraw any number of hearts, even if you don't have that many. This means on a public server, it's very easy for someone to "withdraw themselves to death" (literally upon doing so they'll be banned) this isn't a problem until they get revived, and now they can have hundreds of heart crystals

To Reproduce
Steps to reproduce the behavior:

1. Open a cheats enabled world (to make things easier)
2. go into survival (assuming in creative) and use the command "/ls withdraw @A 64"
3. assuming you're in a single player world, go into creative, otherwise, you'll need to get unbanned (or revived)
4. profit?

Expected behavior
Well I think the best way to handle this would be to reject the command and say you don't have that many hearts, and also post a message to the logs, to warn moderators (but at least don't let the withdraw more than they have)

Screenshots
I didn't take any, but it's easily reproducable

Additional context
None needed tbh

I could've sworn I had something to prevent this 🤔

Thank you for letting me know, I'll take a look into it.

I could've sworn I had something to prevent this 🤔

Thank you for letting me know, I'll take a look into it.

I didn't read the code that well, (and I'm not too experienced with Java) but I didn't really see anything to stop it, definitely may have missed something though. Thanks for the quick response 😁

No problem, and actually thanks a lot for taking this to my attention. I realized a few vulnerabilities in the withdraw command that I need to fix.

I believe in the next update, I'm gonna make withdrawing only available for hearts you've earned rather than hearts you have. So you must HAVE additional max hearts to withdraw, you cannot withdraw beyond default heart count. It might throw off gameplay for others that rely on this, but I think it's a good way to balance the withdraw command.

No problem, and actually thanks a lot for taking this to my attention. I realized a few vulnerabilities in the withdraw command that I need to fix.

I believe in the next update, I'm gonna make withdrawing only available for hearts you've earned rather than hearts you have. So you must HAVE additional max hearts to withdraw, you cannot withdraw beyond default heart count. It might throw off gameplay for others that rely on this, but I think it's a good way to balance the withdraw command.

Pretty awkward, but I've just noticed the problem was my understanding of the config. Turns out that the protection against over-withdrawing is actually disabled by default (or maybe I made a mistake, lol) and it's listed under the maximums as "Maximum Amount Of Hitpoints a Player can Lose:" by setting this to 18 you'll make it so the player cannot withdraw more than 18 hitpoints, or 9 hearts.

Sorry for the confusion 😅 and thank you for looking into it. I think it would be good to work on the explanations of the config (which I might actually do myself if that's not an issue)

I think in regards to needing additional hearts to withdraw, there should be a config to disable the functionality, as it's pretty nice to have the ability to trade your hearts (even if it puts you under 20 hp)

edit: should I close the issue since technically there wasn't a problem (but rather a misunderstanding on my part)?

You can redo the explanations on the config if you want! I'm not that great at explaining tbh. As for closing the issue, honestly that config isn't really there to prevent over withdraw. That's meant as a gameplay feature thing if you didn't want players to lose that many hearts, so we can keep this issue up.

Solved in versions 7.0.0 and up