Macro Dupe and Spear Checks in FairPlay

What do the macro checks observe?

FairPlay's macro group has four public checks: MacroDupeDamage, MacroDupeShield, MacroDupeShieldSlam and MacroSpear. Each one watches for a short run of actions that is unusually tidy when a hand performs it. They report sequences of events, not single clicks, so the evidence is always a small group of actions close together.

Treat each name as the subject of the check, not as a guarantee of what the sequence was. A macro alert says the sequence looked automated. Reviewers still have to establish what the player did.

In practice, a macro alert opens a review rather than closing one. Write down what you saw, which evidence supported the alert and which legitimate explanations you ruled out, so the next reviewer can follow the same path without rebuilding it.

Which macro behavior do these checks target?

A macro binds several actions to one key. Common examples include a key that swaps to a shield, attacks, and swaps back, or a key that repeats an action to multiply its effect. Duplication tools rely on repeated events arriving in a pattern that a person would not produce, and macro tools rely on the same timing every time.

The four checks cover different parts of that idea. The damage check looks at repeated damage from one action. The shield check looks at the order of shield actions. The shield-slam check looks at a shield break followed quickly by a second action. The spear check looks at a spear-style attack sequence. The public names are enough to guide review, and the exact evidence used sits in the code.

What legitimate play can resemble a macro?

A fast player in a combat-heavy mode can produce tidy sequences by practice. Shield-heavy PvP often has a shield break followed by an attack in a short window, which is a normal combo. Some players bind a legal keybind that swaps items on one key, and that keybind alone does not show automation.

Lag is the most common source of confusion. When the server receives several packets together, one action can look doubled, or two normal actions can look like one repeated action. Spear-style and trident-style weapons also produce their own combos in ordinary fights. Review these cases against the weapon the player held and the ping for the same second.

How should staff review macro alerts?

Start with the alert name, then look at the evidence that matches it. The table gives the first thing to inspect for each check and one common legit explanation to rule out.

What is a safe procedure for a macro flag?

Macro evidence is short and easy to misread, so reviewers should follow the same steps every time. The procedure below keeps the review focused on the sequence rather than on the player's skill.

• Confirm the alert names a sequence of events, not a single event.
• Check the ping and recent packet timing for the same second.
• Compare the player's sequence with their own history on the same weapon.
• If your policy allows it, ask for a short voluntary recording of the fight.
• Record the decision and the evidence used, including what you ruled out.

What should you tune only in staging?

Macro checks depend on timing relationships between actions, so they are sensitive to the server's combat settings and the client mix. Test in staging with recorded legit combat and PvP sessions that use the keybinds and weapons your players actually use. Change one check at a time, and keep the family alert-only until reviewers agree on what a real macro looks like on your server.

Do not copy settings from another server. The same sequence can mean different things with a different knockback setup or a different shield rule.

If you change a macro-related setting, note the version and the date, then re-check the alerts a week later with the same staff members, so you can see whether the change alone moved the results.

What have we not verified?

We have not measured how often these four checks fire, how they respond to each keybind layout, or how they compare with macro detection in other anticheats. This article describes what the checks are named to observe. It does not claim that any of them catch every macro or that a given alert is correct.