Hacker hacking in game points

Help and Feedback Scripting Support
#1

This hacker hacked my games point systems.

  1. What is the issue?
    https://media.discordapp.net/attachments/883798029331759106/883798080372240435/unknown.png 
local PointManager = {}
local rs = game:GetService("RunService")

function PointManager.AwardPoint(Plr,Amount)
	if Plr:FindFirstChild("leaderstats") then
		if not rs:IsServer() then warn("Cannot use client for point manager!") end
		Plr.leaderstats.Points.Value = Plr.leaderstats.Points.Value + Amount
	end
end

return PointManager

Exploiters are somehow able to use this module to give themselves points.

#2

Are there any local scripts or server scripts using the module?

#3

The main issue you have here is that your not returning the if statement if it passes as true. E.G

if not rs:IsServer() then 
   warn("Cannot use client for point manager!")
   return
end

Otherwise the function will still continue after triggering the warning and still continue adding points.

1 Like
#4

Are you sure the error is replicated to other players? Only the server can change leaderstats and have it be replicated. It may just be their own client seeing that.

#5

is this script/module located in replicatedstorage? if so, place it in serverscriptservice or somewhere the client cannot access

#6

Hi. I believe hackers can give themself points because there is remote event that is firing module on server which means your check in module would not work, Try to search remote event that award players and dont have any server checks

#7

fixed, it wasnt the module, I fixed it.

#8

What was the problem (for future ppl with the same problem)

#9

it wasnt in the module, so it wont help anyone else, it had nothing to do with that code.

#10

for people with the same problem as the post owner, a possible solution: Put the module in serverscriptservice or in any place the client cant access (LocalScripts cannot access, Normal scripts can, as normal scripts are server-side, whereas localscript is client-side, and when the player cheats, the “script”/“executor” is localscript)

1 Like
#11

The problem was most likely the fact that he had an unsafe remote fired to a server script which called out the module, so he assumed it was the module that was at fault. Firing the function from a executor will not do anything (@Woesus) as it will fire the module locally, meaning the change would only appear for the client.

1 Like
#12

no, Im not that dumb, I had a twitter code ui which gets my codes from glitch.com.

Roblox datastore is laggy, so people could spam the remote for the twitter code, so I added a debounce. Basically added a table for the players that redeemed a code so that even tho datastore was lagging the current server still knew they redeemed that code.