How do you prevent exploiters from moving NPCs around when they have network ownership?

Hey all! Currently, when an NPC is moving around, the player with the network ownership can simply teleport it somewhere else, which is really bad for bosses and the likes.

Setting network ownership to nil doesn’t scale very well because roblox server physics are too slow at updating, making them slow down to a crawl when there are 3 or more npcs.

I think the ideal solution would be to store an NPC as a position on the server, and tell each client to create a rig where the position is. Problem is, I really don’t know where I’d even start with making an NPC that exists purely in code, and have it still behave like a regular roblox character.

The other solution I have in mind is to apply anti-exploit checks to NPCs, such as if they’re found flying / noclipping / moving too fast the network owner gets punished for it. I still feel like players would be able to exploit this, though.

Anyone has a solution?

Maybe create a cosmetic NPC on the client and have an invisible one on the server? This would probably make BillboardGuis and such delayed, but it’s most likely going to be better than before.

This doesn’t really do a whole lot on it’s own. The player can just teleport the invisible one instead of the client one.

Don’t give them network ownership on the invisible one. The cosmetic one would be only visible to them.

The invisible one then gets throttled when too many NPCs are active (~3). I have tried this before without success.

When an NPC is moving around the player can get NetworkOwnership, but, all methods of moving the NPC causes that?
For example, Tweening the primary part of the model, which is anchored, moving it server side, that wont cause the player to have ownership of that.

When using Walk on the humanoid I guess that causes the networkownership changing

No, simply setting the network ownership to nil prevents the player from having network ownership regardless of which method is used to move the character.

The issue, again, is that the server is too slow at calculating physics for more than roughly 3 npcs, and the npcs end up moving at like 1 stud per second.

Now I understand. So, if you force the ownership to server, the server is too slow to do the calculations for the NPCs.
What physics calculations your NPCs are doing?
In interested on how you will solve this

Just regular humanoid physics. Things like :MoveTo(), jumping, etc. Most humanoid states can be disabled.

When I made like 20 zombies chasing players using MoveTo(), not jumping just climbing by walk and with the networkownership to nil, I didnt notice the server doing it slowly, maybe I didnt make sure the NetworkOwnership still in server… and someday clients gonna exploit my silly zombies :joy:

Maybe something else was slowing down the server. I’ll try this solution again and see if I can pin point the source- if it’s something obvious then I can try to change it. Otherwise if it just slows down because of general workload from the server then this won’t work.

1 Like

Out of curiosity, how would you handle NPC hitboxes like this? Say the npc is supposed to be using a sword with raycasted hitboxes, how would you make it work without the actual sword itself existing on the server, or having the necessary limbs to play out the animation?

It seems like NPCs aren’t being throttled, even at upwards of 60 concurrent NPCs… I really wonder why exactly it was as choppy as it was previously.

Any update regarding this? I am also experiencing the same issue of where exploiters can move npcs into the void and kill them, and its a shame that setNetworkOwner doesn’t work in serverstorage otherwise i could change the Ownership of the npcs while they’re still stored before parenting them to workspace. Because can’t a hacker just run a quick repeat loop till it detects the npc being parented to workspace and quickly void them before I can set the network ownership?

I just set network ownership to nil right as the npc is parented to workspace

ownership of the npc’s primarypart only?

Yeah, but I’d also recommend doing as @GibusWielder said and only having the primary part on the server and putting the actual rig on the client.
It means the server doesn’t have to take into account the physics for each motor6ds, which should help lower the workload on the server

how do i go about doing this client stuff?, like putting rig on client can you tell me step by step? because I play attacking animations on server, and how would run animation work too

Weld a cosmetic rig on the client and play the animations from the client on that cosmetic rig. You can’t play animations from the server but you can always just fire to the clients when an animation is supposed to happen.

Thank you so much! I have another question if that’s ok, for the dummy on the server, what do I do with the other limbs like RightHand / RightUpperArm, etc. Do I make it transparency or just delete all of them except Head, Humanoid & HumanoidRootPart?