Crate system could be exploited?

No need for coded examples here, the animation and everything can be done on the client but you should pre-determine the item beforehand and then tell the client to do the animation that ends up telling them the item they got.