Help stopping exploiters using remote events

Help and Feedback Scripting Support
1

I have recently found out that people are exploiting in my game: (6) [MINIGAMES!] Limited Life! - Roblox

I have found out that they are most likely using this remote event which gives the player time (currency)

remote2.OnServerEvent:Connect(function(plr,Reward)
	local info = plr:WaitForChild("Info")
	local seconds = plr:WaitForChild("leaderstats"):WaitForChild("Seconds")
	
	if mps:UserOwnsGamePassAsync(plr.UserId,64753824)then
		info:WaitForChild("Earned").Value += Reward*1.5
		seconds.Value += Reward*1.5
	else
		info:WaitForChild("Earned").Value += Reward
		seconds.Value += Reward*1.5
	end
	
	info:WaitForChild("Tasks").Value += 1

end)

Is there anyway I can stop exploiters from firing this?

1 Like
2

You’re allowing the client to the tell the server what should be given to the player, that has to be done server-sided

3

I don’t understand? That script is server-sided and I need it to be fired from the client or else it wont work since its UI

4

What does the UI contain? Exploiters are just doing this:

RemoteEvent:FireServer(100000)

The script is server-sided, but the information is coming from the client, which can be manipulated

Here’s an example:

A shop customer telling the owner how much something is, then paying at that price

5

Try making sure the script that is firing the remote event is allowed.

6

They have to do a task and then it fires to the server. I believe I came up with a solution.
Would this work:

  1. When remote is fired where it should be a variable in the client script is changed.
  2. Server fires a remote to client to check if the variable is true
  3. If it isn’t the remote is fired but the reward is now negative so it takes it away
7

That unfortunately wouldn’t work because that would rely on the client being truthful. How is the reward calculated on the client, it could possibly be moved to the server

1 Like
8

You have to implement sanity checks on the server in order to properly secure your remotes. The rule of thumb is to never trust the client - always assume everything they send could be untruthful.

A good example is this: Say you have a gun that sends a remote every second the mouse is held down to make the server shoot a bullet. An exploiter could bypass the rate of fire of the gun and make it shoot extremely fast.

So on the server script, you implement a variable that keeps track of the last time someone shot, and if the next time they shoot is before the cooldown time, then you know something’s fishy with that particular player. You could then prevent the bullet from being fired, you could kick/ban the player, send him a mean message, etc.

1 Like