How to make my combat system more secure

Help and Feedback Scripting Support
#1

Hello everyone. My combat game uses attributes to keep track of player states (attacking, blocking, stunned…) and i need to keep track of them in the server for more security. but if i wanted to make a punch then i would need to fire a remote event to let the server know that the player is attacking, the problem is that if i do so then i would need to make everything on the server (hitbox, animation…) and that could cause server lag. Now second solution is that i create the hitbox on the client play the animation and wait until its finished and THEN fire the remote event after the punch is finished but then the server won’t know if the player was already attacking or not.

Here’s the code that i use :

local player = game.Players.LocalPlayer
local character = player.Character or player.CharacterAdded:Wait()
local humanoid: Humanoid = character:WaitForChild("Humanoid")
local humanoidRootPart = character:WaitForChild("HumanoidRootPart")

local overlapParams = OverlapParams.new()
overlapParams.FilterType = Enum.RaycastFilterType.Exclude
overlapParams.FilterDescendantsInstances = {character}

--Services
local ReplicatedStorage = game:GetService("ReplicatedStorage")

--Modules
local hitboxModule = require(ReplicatedStorage.Modules.Hitbox)
local canAttackModule = require(ReplicatedStorage.Modules.CanAttack)

--Events
local punchEvent = ReplicatedStorage.Events.PunchEvent

local animations = {
	humanoid:WaitForChild("Animator"):LoadAnimation(script:WaitForChild("Punch1"));
	humanoid:WaitForChild("Animator"):LoadAnimation(script:WaitForChild("Punch2"));
	humanoid:WaitForChild("Animator"):LoadAnimation(script:WaitForChild("Punch3"));
	humanoid:WaitForChild("Animator"):LoadAnimation(script:WaitForChild("Punch4"));
}

UserInputService.InputBegan:Connect(function(input, gpe)
	if gpe then return end
	
	if input.UserInputType == Enum.UserInputType.MouseButton1 then
               --Fire the remote event now or wait until the attack is finished and fire the event
	end
end)

If you need more clarification i would be happy to respond.

#2

Have you tested if this does cause server lag? I have a similar system and most of it is managed on the server.

#3

Sorry for the late response ! I partially did and it’s pretty smooth but i saw on the devforum that doing too much stuff on the server is laggy.

#4

Also making the hitbox on the server has this issue where when you want to place the hitbox infront of the player it positions itself near the player the gap increases depending on the player’s ping so you’ll need to get the position of the player in the point of view of the client so that the combat feels smoother but then hackers can spoof the remote event and send incorrect data to the server so you’ll need sanity checks and all of that stuff