This past week, I’ve been sent multiple clips of people seemingly desyncing to the server and teleporting, giving them a major competitive advantage in our game, Volleyball Legends. It turns out that these are FFlags that anyone can modify, which I have attached in the private comment.
In the video attached, you can see the player ‘kayisalreadytaken’ freezing and teleporting around.
Note: This appears completely normal on the client using these FFlags
There are additional methods to achieve this desync invisibility which I reported. It somehow manages to break server->client replication, so that your position is still being updated on the server but other clients are not receiving update packets. Perhaps @MrEakar can relay more of this info to the networking team so they can attempt to patch this vulnerability, one which has existed for many years now.
This is still not fixed despite the fflag update. This ‘invisible desync’ exploit is still being used across numerous games. It will not go away until the networking team looks into the issue and improves their replication methods.
No idea if anyone here knows about this or realizes it, but I’ve heard that it’s possible to do it by temporarily and quickly cutting off the internet connection such as by turning on airplane mode for a few seconds then quickly turning it off.
This particular report refers to desyncing with FFlags (outlined in the associated private message). We are aware that there are other methods that can be used to achieve similar effects.
Thank you for raising awareness about lag switching. Sadly, this is a technique that is very common across all online platforms and games. Lag switches come in many forms: briefly disconnecting the internet as you described, dedicated hardware lag switches, and software lag switches. Finding solutions to this form of attack is very challenging.
That’s usually players intentionally forcing their client to desync through internal or external memory manipulation. I’m glad the fast flag changes are addressing this, because before it could be done directly with raw fflags, which let even non exploiters abuse it and made the issue more widespread.
Creating an allowlist for certain fflags and removing network related ones from the main client is a solid first step, and I’m glad that was taken
The issue with this desync is not the same as lag-switching. With lag switching the server stops receiving your updates, and then when resumed there would be a ‘teleport’ on the server in a client-authoritative system. This vulnerability continues sending positional updates to the server (which accepts them), but somehow tricks the server into not replicating said updates to other clients. This effectively allows the user to appear ‘invisible’ while also appearing 100% valid on the server as well. This was achieved through fast flags as well as other methods, but the core vulnerability still exists.
I am glad the fast-flag abuse is being patched, maybe if this issue continues to resurface a new topic is warranted with more specific information.
