Client can break joints and kill server sided enemies, even with FE

Simple as the title suggests, clients, even if the game is FE, can kill ALL server sided NPC’s (In my case zombies) with this simple bit of code. (Its setup to work with my game but you should be able to get the gist, its really simple)

for i, c in pairs(game.Workspace.Zombies:GetChildren()) do

Code has been tested on one of my games I am working on, It has worked for a very long time, only now getting around to reporting it as a fix is definitely something needed.

I don’t want exploiters to have the ability to beat a wave of zombies by just running 3 lines of code. It completely defeats the purpose of the game.

This also works in games like Apoc, you can wipe out every zombie on the server by just breaking the joints of the zombies. :frowning:


Does not happen if the server has the network ownership.

Shoot I completely forgot about network ownership… Ill try it right now.

Lol, if they are dead then that’s just client side. The server will still see them as alive.

No it does not.

If it’s FE yes.

Test your theory, it’s a bug.

Ok, I’m confused. It works on FE, then I test again and it doesn’t. This bug is trippy.

Because if a client has network ownership of a part, they have access to break joints, among other things that are whitelisted. This works well for the player’s character, and completely-local bodies, but not-so-much server-sided enemies. Even physics simulation can be abused though (owner can tell server to move NPC 1000 studs away), so while distributing physics to clients is a good thing in its own way, it opens up a door for exploiting, so maybe it should be revisited.

I just tested setting the network ownership of the zombies, even with every part in the zombie set to the ownership of the server, there are still issues.
All zombies die on client 1 that runs the code, on client 2 the zombies are still ‘alive’ now (that’s a step in the right direction), but here’s where it gets crappy again. The server still registers them as having died, and stops their path finding. (Yet they are still there just standing still on the server (with full health) just like on client 2)