To prevent abuse, GMs should be permission restricted (via GM level) to trade with other non GM players, use their storage (prevent transferring to their other characters), send via Duey and to drop items. GM level is configurable.

config.yaml

@@ -461,6 +461,12 @@ server:
     #Event End Timestamp
     EVENT_END_TIMESTAMP: 1428897600000
 
+    # GM Security Configuration
+    MINIMUM_GM_LEVEL_TO_TRADE: 4
+    MINIMUM_GM_LEVEL_TO_USE_STORAGE: 4
+    MINIMUM_GM_LEVEL_TO_USE_DUEY: 4
+    MINIMUM_GM_LEVEL_TO_DROP: 4
+
     #Any NPC ids that should search for a js override script (useful if they already have wz entries since otherwise they're ignored).
     NPCS_SCRIPTABLE:
       #9200000: Talk to Cody # Cody

src/main/java/client/inventory/manipulator/InventoryManipulator.java

@@ -706,6 +706,12 @@ public class InventoryManipulator {
         Inventory inv = chr.getInventory(type);
         Item source = inv.getItem(src);
 
+        if (chr.isGM() && chr.gmLevel() < YamlConfig.config.server.MINIMUM_GM_LEVEL_TO_DROP) {
+            chr.message("You cannot drop items at your GM level.");
+            log.info("GM %s tried to drop item id %d", chr.getName(), source.getItemId());
+            return;
+        }
+
         if (chr.getTrade() != null || chr.getMiniGame() != null || source == null) { //Only check needed would prob be merchants (to see if the player is in one)
             return;
         }

src/main/java/client/processor/npc/DueyProcessor.java

@@ -284,6 +284,13 @@ public class DueyProcessor {
     public static void dueySendItem(Client c, byte invTypeId, short itemPos, short amount, int sendMesos, String sendMessage, String recipient, boolean quick) {
         if (c.tryacquireClient()) {
             try {
+                if (c.getPlayer().isGM() && c.getPlayer().gmLevel() < YamlConfig.config.server.MINIMUM_GM_LEVEL_TO_USE_DUEY) {
+                    c.getPlayer().message("You cannot use Duey to send items at your GM level.");
+                    log.info(String.format("GM %s tried to send a package to %s", c.getPlayer().getName(), recipient));
+                    c.sendPacket(PacketCreator.sendDueyMSG(DueyProcessor.Actions.TOCLIENT_SEND_INCORRECT_REQUEST.getCode()));
+                    return;
+                }
+
                 int fee = Trade.getFee(sendMesos);
                 if (sendMessage != null && sendMessage.length() > 100) {
                     AutobanFactory.PACKET_EDIT.alert(c.getPlayer(), c.getPlayer().getName() + " tried to packet edit with Quick Delivery on duey.");

src/main/java/client/processor/npc/StorageProcessor.java

@@ -52,6 +52,13 @@ public class StorageProcessor {
         Storage storage = chr.getStorage();
         byte mode = p.readByte();
 
+        if (chr.isGM() && chr.gmLevel() < YamlConfig.config.server.MINIMUM_GM_LEVEL_TO_USE_STORAGE) {
+            chr.dropMessage(1, "You cannot use the storage as a GM of this level.");
+            log.info(String.format("GM %s blocked from placing items in storage", chr.getName()));
+            c.sendPacket(PacketCreator.enableActions());
+            return;
+        }
+
         if (chr.getLevel() < 15) {
             chr.dropMessage(1, "You may only use the storage once you have reached level 15.");
             c.sendPacket(PacketCreator.enableActions());

src/main/java/config/ServerConfig.java

@@ -309,6 +309,12 @@ public class ServerConfig {
     //Event End Timestamp
     public long EVENT_END_TIMESTAMP;
 
+    //GM Security Configuration
+    public int MINIMUM_GM_LEVEL_TO_TRADE;
+    public int MINIMUM_GM_LEVEL_TO_USE_STORAGE;
+    public int MINIMUM_GM_LEVEL_TO_USE_DUEY;
+    public int MINIMUM_GM_LEVEL_TO_DROP;
+
     //Custom NPC overrides. List of NPC IDs.
     public Map<String, String> NPCS_SCRIPTABLE = new HashMap<>();
 }

src/main/java/server/Trade.java

@@ -448,6 +448,20 @@ public class Trade {
     }
 
     public static void inviteTrade(Character c1, Character c2) {
+
+        if ((c1.isGM() && !c2.isGM()) && c1.gmLevel() < YamlConfig.config.server.MINIMUM_GM_LEVEL_TO_TRADE) {
+            c1.message("You cannot trade with non-GM characters.");
+            log.info(String.format("GM %s blocked from trading with %s due to GM level.", c1.getName(), c2.getName()));
+            cancelTrade(c1, TradeResult.NO_RESPONSE);
+            return;
+        }
+
+        if ((!c1.isGM() && c2.isGM()) && c2.gmLevel() < YamlConfig.config.server.MINIMUM_GM_LEVEL_TO_TRADE) {
+            c1.message("You cannot trade with this GM character.");
+            cancelTrade(c1, TradeResult.NO_RESPONSE);
+            return;
+        }
+
         if (InviteCoordinator.hasInvite(InviteType.TRADE, c1.getId())) {
             if (hasTradeInviteBack(c1, c2)) {
                 c1.message("You are already managing this player's trade invitation.");