I've done the tests, there are no bugs,
you have to take it into account:
player.applyDamage(otherPlayer);
- player is victim
- otherPlayer is the attacker
So, otherPlayer must have the sword
Finally, the damage calculation is a little more complex than your description. If the sword has 500 atk, the damage is not 500.
It takes into account the other player's strength (str) and physical defense (pdef).
Here's the formula:
https://github.com/RSamaium/RPG-JS/blob/v3/packages/server/src/presets/index.ts#L47
Example,
with no other configuration, if the attacking player has an attack of 100, the damage will be 435
Finally, it's possible to customize combat formulas:
https://docs.rpgjs.dev/api/RpgServer.html#damageformulas