Client Sided Attack Initiation and Hitbox Issues

Help and Feedback Scripting Support
#1

I’m currently testing out different approaches to combat, many people suggest client sided hitboxes with server validation for the best gameplay experience. However, im having trouble securing this system.

Here’s my current system:
Client input → Client fires to server to update a table that contains all info for the player’s current attack. this table has all valid info.
Most importantly, table contains the amount of times that attack is allowed to hit.

client starts animation and listens to animation markers → hitbox marker is reached.
Client spawns hitbox and gets PartsInPart → client invokes server and sends a list of victims.
Server validates hits
Client fires server when attack ends in order to clear the server table.
boom perfect

Now here’s the problem,
I understand that it’s virtually impossible to make a super secure game while keeping it very smooth for players but I dont think vulnerabilities like what im encountering should exist.
If an exploiter fires the Attack Start remote, they can then spawn a hitbox whenever, then they can fire the Attack End remote and repeat this sequence very quickly to basically have kill aura.

I’ve tried doing timing checks by storing the expected hitbox spawn timings in a config file but it’s difficult to accurately time things when a player has a little bit of lag. (or maybe i did it wrong). I’ve tried starting the animations on the server then invoking the client to spawn a hitbox and such but again, theres too much delay to go from server to client back to server.

Any help is greatly appreciated!

Here’s a bit of code for my serversided attack handler

CombatRemote.OnServerEvent:Connect(function(player, request, AttackType, ClientStartTime, values)
	if request == "Attack Start" then
	
		local DataStore = main.GetPlayerData(player)
		local Style = DataStore.EquipWeapon
		local Weapon = DataStore.EquipWeapon

		if not main.CanAttack(player.Character, AttackType, nil) then warn("CanAttack = false") main.stopAction(player.Character.Humanoid) return end

		if not values.Reference then warn("no reference values passed in") return end

		main.Cooldown(AttackType, player.Character, math.clamp(0, 0.5, 0.5 - player:GetNetworkPing()))
		local AttackingValue = main.effectscreate("NumberValue","Attacking",0, player.Character.Data.Effects)

		local Servertime  = workspace:GetServerTimeNow()

		local AttackTable:AttackTable = {
			["AttackType"] = AttackType,
			["Exemptions"] = nil,
			["Attacking"] = true,
			["ClientStart"] = ClientStartTime,
			["ServerStart"] = Servertime,
			["Value"] = AttackingValue,
			["Possible Events"] = Config[AttackType][Style][values.Reference]["Animation Events"],
			["Used Events"] = {},
			["AttackProperties"] = Config[AttackType][Style][values.Reference]["AttackProperties"],
			["HitboxProperties"] = Config[AttackType][Style][values.Reference]["HitboxProperties"],
			["Misc"] = values



		}
		if AttackType == "M1" and not AttackTable.HitboxProperties.Instance then
			AttackTable.HitboxProperties.Instance = Config.Weapons["Dawncleaver"].Hitbox
		end
		CombatStates.AddAttack(player, AttackTable, AttackType)


		print("Attack started:", CombatStates.StateTable[player])



	elseif request == "Attack End" then

		if not CombatStates.FindCurrentAttack(player) then return end
		CombatStates.RemoveAttack(player, AttackType)
		print("attack end")

	end
end)
#2

Move this to #help-and-feedback

2 Likes
#3

This makes delay thus making the experience worse, now try it in-game and it’ll lag as it requires server authorization.

The attack itself should start when you click on the client, and server replicates that to other clients. If the hitbox spawned by the attack finds any players to damage then fire a remote telling the server you hit a player.

What you should be securing instead is attack logic, cooldowns, distance, etc.

#4

There is no delay because its a fire server, not invoke. The client doesnt wait for server confirmation to start the attack. There is the problem of like 300+ ping players having their attack voided though.
I could probably fix that through getting the player’s ping i think.

Attack logic and stuff is secured but i think its important to make sure that hackers cant desync their hits from the animations.

pretty much need to make it so player’s are never left in the dark and everything visually matches up