You might want some permission checks on the events ps_refunds:server:addRefund and ps_refunds:server:remove to stop people giving stuff out using cheats. Looks good though