[BlueMelon]

Best protection would be use use serverside validation, I know on era some old scripts (even some new scripts *cough*) have been exploited by sending a negative number to server side and then this happens.
player.rupees -= -(xrupees); which results in a positive number.
This can easily be avoided using simple checks, or even abs(num).
But what can you expect, people make mistakes.