Can exploiters make the server think their HumanoidRootPart has a velocity of 0?

I have a modified anti-noclip script from the Devforum that runs on the server end. In order to cut down on raycasts, I made it so rays are only made if the player is moving. Meaning the server will only check if a player is noclipping if their velocity magnitude is greater than 0.

Script inside summary:

Summary
function noclipcheck(chr,root,plr)
	local LastVec = root.Position
	local hum = chr:WaitForChild('Humanoid',10)
	while chr do wait(.04)
		pcall(function()
			if (root.Velocity.Magnitude > 0) then
				local RY = Ray.new(LastVec, root.Position - LastVec) -- Create a RAYCast
				local Hit, Position = workspace:FindPartOnRayWithIgnoreList(RY, {chr,game.Workspace.NonCollidableObjects},false,true) -- Is the Ray touching ANYTHING But the player, and Non Collidable objects?

				if Hit and not Hit.Parent:GetAttribute('filt') and Hit.CanCollide == true and chr:IsDescendantOf(game.Workspace) and not Hit.Parent:FindFirstChildWhichIsA('Humanoid') and not Hit.Parent:IsA('Accessory') then -- If the player is Noclipping, then?... GIIIIVEEEE EMMMMMM' THEEEEEE BOOOOOOOOOOOOOOOOOOOOOOT
					root.CFrame = CFrame.new(LastVec)
					damagemod.Deal(10,1,chr.Humanoid,chr:FindFirstChild('Torso'),'b')
					game.ReplicatedStorage.Sound:FireClient(plr,5909720414,0.1)
				end

				LastVec = root.Position -- Record their last position so then we can see where to raycast.

			end
		end)
	end
	coroutine.yield()
end

However I’m not sure if players are able to make it appear as if they have a velocity magnitude of 0 to the server.

Some other info that might help:

  • I already implemented a server side check for teleport and walkspeed exploits, which checks if the character’s position subtracted from an older position from a second ago is larger than a certain amount. If this is true it damages the player slightly and teleports them to their older position.
  • the “damagemod” module script just takes away health from the player’s humanoid.
  • The function in the Summary is connected to CharacterAdded for every player.
1 Like

I am not sure about the answer on this one however I do not think so. If the velocity is somehow set every frame idk maybe then yes however you can easily get around the problem by using simple maths to calculate the velocity if it isn’t true.(of course this comes with a performance drawback)

I am pretty sure Velocity is the difference of position from an object so if the server calculates physics then I am pretty sure you should be safe.

To my knowledge players have network ownership over their physics, as a result they have full control over Velocity, CFrame, etc.

There is no good work around to this.

3 Likes