Do i have to worry about a hacker sending the incorrect `RmsLevel` value?

so i have a pair of “subwoofer’s” that needs RmsLevel and PeakLevel from the AudioAnalyzer sent remotely from the client

Subwoofer Server Script:

local speaker = script.Parent
local mesh = speaker.Mesh

local Analyzer = speaker.AudioAnalyzer

local RmsEvent = Analyzer.RmsLevelEvent
local PeakEvent = Analyzer.PeakLevelEvent

RmsEvent.OnServerEvent:Connect(function(p, l)
	--mesh.Scale = Vector3.new(1,1,1):Lerp(Vector3.new(1,1,4), l)
end)

PeakEvent.OnServerEvent:Connect(function(p, l)
	mesh.Scale = Vector3.new(1,1,1):Lerp(Vector3.new(2,2,1), l)
end)

Client Script:

game:GetService("RunService").RenderStepped:Connect(function()
	for _, i in workspace:GetDescendants() do
		if i:IsA("AudioAnalyzer") then
			local RMSLevelEvent = i:FindFirstChild("RmsLevelEvent")
			local PeakLevelEvent = i:FindFirstChild("PeakLevelEvent")
			
			if RMSLevelEvent and RMSLevelEvent:IsA("UnreliableRemoteEvent") then
				RMSLevelEvent:FireServer(i.RmsLevel)
			end
			
			if PeakLevelEvent and PeakLevelEvent:IsA("UnreliableRemoteEvent") then
				PeakLevelEvent:FireServer(i.PeakLevel)
			end
		end
	end
end)

the client is going through the workspace using :GetDescendants() on every frame.
and if its a audio analyzer then they check for 2 remotes, if one of the remotes existed then the client will send the values needed for the server.

the thing about that is, the hacker can disable the client script that sends the values from the audio analyzer, like sending the RMSLevelEvent to something like 5 or above the normal value of AudioAnalyzer.RMSLevel.

Do i have to worry about this?

What you are describing is a bit complicated but from what I am understanding you are sizing a mesh based on the audio analyzer being present? A hacker can surely disable the client script… they can also send info from remote events from their client to the server. I don’t think there’s anything to worry about though unless something bad would occur from them not having the audio analyzer or from them simulating the remote events at their own speed since your remote event has no cooldowns. This is a classic sanity check. So you need to ask yourself here what it is that could go wrong if you can disable that client script, if you are passing false information as true information, or if you are event spamming. The RmsLevel is easy to check on the server you just verify valid numbers and check if it’s the correct number or not. Example below.

RmsEvent.OnServerEvent:Connect(function(p, l)
       if RmsLevel > 5 then
       p:Kick()
       else
	--mesh.Scale = Vector3.new(1,1,1):Lerp(Vector3.new(1,1,4), l)
       end
end)

My question is, why do you need the client to be sending all the RmsLevel and PeakLevel values to the server?

I see that the functionality you showed scales the speaker based on either RmsLevel or PeakLevel. You can do so without having to send the information to the server but rather do it all on the client’s side. That way you can also reduce overhead on the server.

If you still want it to be separated into server/client, then you will have to implement security checks. Here are some examples that may or may not be related to your case:

  • Type assertions on the arguments provided by the client
  • Checking if the value is in range of [a, b]
  • Clamping values like math.clamp(x, 0, 1) which would return 1 at max and 0 at min.

There are so many other ways you can implement security into events but it comes to what’s better and suitable for your situation.

TL;DR I don’t think there’s much worry if the goal of those events is to scale a mesh, but I still recommend implementing a way to limit the value of l for both events.

1 Like

youre right, i shouldve done this in client side instead of sending a remote event to the server to change the scale of the mesh.

1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.