The bug

/scoreboard players <targets> <targetObjective> >< <source> <sourceObjective> can mutate source scores even though <sourceObjective> is read-only.

How to reproduce

1. /scoreboard objectives add writable dummy

2. /scoreboard objectives add readonly air

3. /scoreboard players set value writable 42

4. /scoreboard players operation value writable >< value readonly

5. /scoreboard players get value readonly

   value has 42 [readonly], the score value in the objective readonly is mutated.

Code analysis

• net.minecraft.server.commands.ScoreboardCommand

  performOperation(
      commandContext.getSource(),
      ScoreHolderArgument.getNamesWithDefaultWildcard(commandContext, "targets"),
      ObjectiveArgument.getWritableObjective(commandContext, "targetObjective"),
      OperationArgument.getOperation(commandContext, "operation"),
      ScoreHolderArgument.getNamesWithDefaultWildcard(commandContext, "source"),
      ObjectiveArgument.getObjective(commandContext, "sourceObjective") // accepts all objectives here (including read-only)
  );
  

• net.minecraft.commands.arguments.OperationArgument

  private static Operation getOperation(String string) throws CommandSyntaxException {
      return string.equals("><") ? (score1, score2) -> {
          int integer3 = score1.getScore();
          score1.setScore(score2.getScore());
          score2.setScore(integer3); // mutated here
      } : getSimpleOperation(string);
  }