Anti-exploit checks?

[ClassicMasterNoob]

I have a gun system with a damage remote.
I pass the localscript as one of the arguments in the remote.
Is this a viable way of checking if the remote has been fired by the proper script or an injection? Or do exploits have a way of mimicking localscript instances?

LOCALSCRIPT:

remotes.DamageRemote:FireServer(tool.Barrel.Position, char, damage, mouse.Target, script)

SERVER SCRIPT:

remotes.DamageRemote.OnServerEvent:Connect(function(plr, barrelpos, target, damage,playerMouse,scriptCheck)
	if scriptCheck.Name == "Gun" then
		print(plr.Name.." has fired damage remote")
	else
		warn("Exploit detected from user "..plr.Name)
	end
	if target and playerMouse:IsDescendantOf(target) and target.Humanoid and target.Humanoid.Health > 0 then
		target:FindFirstChild("Humanoid"):TakeDamage(damage)
		tagplr(target.Humanoid, plr)
		if target.Humanoid.Health > 0 and not target:findFirstChild("ForceField") then
			local stats = plr:FindFirstChild('leaderstats')
			if globalsettings.KillsDamage == true then
				stats.Damage.Value = stats.Damage.Value + damage
			end
		end
	end
end)

[ClassicMasterNoob]

I don’t think that’s how exploits execute their code. They don’t have to inject a script instance into the game in order to run their exploits.

[walshuk (vincenzo)]

Never trust the client.

Although the script you have at the minute is fool-proof and would defer less advanced exploiters, it still relies on client information and doesn’t do any thorough server-side checks to ensure legitimacy. If exploiters really wanted to, they could spy on the information being passed through the RemoteEvents and manipulate that for their own advantage.

Also, in regards to your question, exploiters can still pass through the same LocalScript as an argument.

[Kostiskat (kostis)]

I made an interesting article on exploits, perhaps that could give you an idea on how to work with remotes

How to: Use Remote facilities correctly

How to: user remote facilities correctly tutorial designed and presented by Kostiskat Recommended material for this tutorial: Roblox Client-Server Model Remote Functions and Events : Introduction Hello, everyone! As I am embarking on a new series of posts, here on the DevForum, I would like to officially introduce myself with this first topic regarding remote facilities (events & functions). This is my first post, so if you have any constructive feedback, feel fre…

[Kostiskat (kostis)]

@Kostiskat

Similarly, with remote facilities, the messenger (remote events/functions), should not alter any messages sent by the client. Essentially, when firing remote events or functions, you should seldomly to never pass any values, unless rendered completely necessary. Remember! Use remote events and functions wisely. For example, when making the shop, don’t check if the player has the coins on the client, and then fire the event. Don’t tell the server:

I want to buy this item.

but rather:

Can I buy this item?

The message isn’t altered whatsoever, the server receives the message, checks if the player has enough coins, and proceeds to cancel or confirm the purchase.

Quoted from the article, I think this will help you out the most.

The server the one who processes all purchases, remote events should just work as an alert for the server to do backround checks and act accordingly.

[zamd157 (intelsyntax_enjoyer)]

An exploiter can literally send a table with a key named Name with the value "Gun". They can also put functions such as IsA to return true.
You shouldn’t rely on passing extra parameters to detect exploiters.