Can Exploiters still fire PromptPurchase() to steal Free UGC Limiteds?

[Neutron_Flow]

Yes this is fixed, PromptPurchase() must now be called from the server when being used for ANY limiteds.

As to why PromptPurchase() can be fired from the client: probably because for the majority of transactions it’s unnecessary to go from Client → Game Server → the Roblox server that handles item purchases. The game server is an extra stop if the user is initiating the request to buy something.

---

Here is the post where they made the update to fix the exploit:

Temporary Issue with “Experience By Place ID” Sale Location

[Update] July 31, 2023 [Update] June 28, 2023 [Update] June 15, 2023 Hi Creators, We recently launched a new Sale Location option for UGC Limiteds that allows creators to set their items to be acquirable in-experience only. With this, we saw Creators uniquely utilizing avatar items – for example, to power their experiences with prizes or hand out merchandise that is exclusive to an experience. We received reports that some users are currently using exploits to purchase Limited items wit…

Here’s the relevant section:

@Roblox

This will come with some changes to PromptPurchase for the in-experience purchasing of Limiteds. PromptPurchase must now be called from the Server in order to successfully facilitate the purchase of a Limited item. This will affect the in-experience purchasing of all UGC Limiteds, not just those with the Experience by Place ID Sale Location. Successful purchases of non-Limiteds can still be prompted from the Client.