Help with server validation for client position script

Help and Feedback Scripting Support
,
#1

I am sending a cframe that is supposed to be a position infront of the player to the server, using a remote event

To check if it is valid I do this on the server

Event.OnServerEvent:Connect(function(Player, ClientCFrame)
	local Character = Player.Character
	local Humanoid = Character:FindFirstChildWhichIsA("Humanoid")

	local CharacterCF = Character:GetPivot()
	local CharacterSize = Character:GetExtentsSize()

	local Ping = Player:GetNetworkPing()

	local studsPassed = Humanoid.WalkSpeed * Ping
	local normalized = Humanoid.MoveDirection * studsPassed
	local predictedClientPosition = CharacterCF.Position + normalized

	local difference = (ClientCFrame.Position - predictedClientPosition).Magnitude

	if difference < 25 then
		print("not hacker")
	else
		print("hacker")
	end
end)

Is this a reasonable way to do this?

1 Like
#2

I don’t think soo, see walkSpeed is not in studs per second, you should get player’s magnitude as constant (use script to get this value) and then compare it using simple math

For example

local Magnitude = 20 -- let's say it's our default magnitude
local MaxDistance = 40 -- our max distance

-- code, remote gives tick() as third argument

local timePassed = tick() - lastTick -- ping
local CurrentPosition = player.Position

local Difference = CurrentPosition - LastPosition
if Difference / Magnitude + timePassed > MaxDistance / Magnitude + timePassed then
  -- player cheated
end

it’s only suggestion, it might not work as intended but try

#3

Hey I checked and it does mean how fast a player walks every second sorry for the inconvenience

#4

nice, soo u can edit and play with my script to see if it works

#5

Ok I will try it thank you
[30]

1 Like
#6

Wait couldn’t the exploiter just send a fake tick() through the remote event to make it look like that it has passed longer

#7

he can, you can’t do anything about that

#8

That’s why I am using NetworkPing

#9

it’s not precise, you can simply don’t use it, but then don’t kick people, but maybe freeze them or teleport back to original position

1 Like
#10

You can do all of this without a RemoteEvent.
A Exploiter can just prevent the RemoteEvent from being fired by hooking :FireServer or disabling the LocalScript that fires the RemoteEvent

1 Like