I am making a gun game and do not know how to make anticheat for it really. (I use raycast so bullets are instant)
What I have right now:
When player shoots it will send message to server and include in that message info about whether he hit anyone or not. With that info will include the target model, the target part (the part that was hit) and the position of that target part at that time along with current position of the character.
On the server it will get the new character position (to adjust for ping) and the new position of the target part and see if they are in a reasonable distance from each other. Server then will draw a line between the old target position and the old character position and if there is a wall then it will cancel the shot.
I do have verification for health and ammo and that sort of stuff
Is there any way to make this more secure?
Any help is appreciated
Oh i thought you were passing target model and target part and all that stuff. What I was thinking is that you only need to send the mouse direction when firing the remote event from the client(so you can give the raycast a direction), and then on the server, you can get plr.Character from OnServerEvent, shoot the raycast from there, and then raycast will return whatever result and you damage the player or whatever.
from what you are saying I think you are doing these calculations client side first and then firing the event to see if those calculations match when they are ran on the server? I’m not really sure about what you mean by verify , you should just do everything on the server
I am sending the target from the client side because of the ping delay. When the player clicks the target character is at a different position than when the server reads the remoteevent
If you have 100 ping i think the latency is barely noticeable, but I guess if you had more than 150 then you would feel it. There is this new matchmaking thing I saw that where you can make it so the latency weight is more important than the other factors when placing a player into a server.
Otherwise if you go with your client side approach, i think itll just give hackers room to take advantage of your code.
The characters have 32 walkspeed to match the style. I am using the client like I am using it already, I just need help with server verification and that is all I am asking. I am not asking for help on my entire system just the server verification
alr bro if you want some freaky 2 step authentication email type of verification then you just compare the values from what the client is sending to the server, and then have some distance threshold, so if its like 2 studs off from where the plr actually was then just register the hit.
I was doing 15 studs for the target model and the character model because of the speed, that would be the usual distance difference with a ping of 200 which is average. I also have verification for walls
Can check the player’s last shot time, to make sure the fire rate is not suspicious (like firing 500 rounds in a second), of course check the damage to matchup with the weapon they are firing with
Raycast on server and client, send this position to server from client of hit result, normalize vector direction vector.normalize(root.Position-pos) and then multiply it by whatever number of studs you want to raycast.
Essentially locks target hit position regardless of where player went yet keeping it secure.
The validation section of the gameplay scripting curriculum on Roblox’s creator docs site covers some decent validation ideas.
These are the validations they do, some of which overlap with what you’ve mentioned:
Validate the data from the client is of the expected type
Validate if the rays are pointed near the expected angle based on the gun’s orientation, with tolerance
Validate if the shooter is actually near the claimed origin point, within tolerance
Validate if the player being shot is actually near the claimed hit point, within tolerance
Simulate the raycast again on the server to check if anything is obstructing the path between the origin and hit point
Besides specific ray validations, it also re-simulates the gun statistics on the server like shot pacing, bullet count, and reload time.
This is a pretty good best effort without working out a crazy custom solution for recording positions and attempting to create a source-of-truth synced historical replay of events.
It’s not a perfect system of course. For example, the faster the players can move / the higher the ping a player has, the larger the tolerance you need. And in the case of something like validation #5, if the map is dynamic or another player moves into the path, the server could find an obstruction that didn’t exist to the client.
You can also build in a trust score to your system. If a player is repeatedly failing validations, they are probably less trustworthy of a client and may be exploiting. If a player has a high trust score, you might allow them a little more leniency and for example allow a shot that fails 1/5 validations to register a hit anyway since it might have been caused by latency.
, you should just do everything on the server