How to prevent client from abusing RemoteEvent to get infinite cash

In the specification, he asked for a system where you can claim cash based on clicking on a button, thus this would be required. Sure, in a automated system where you earn it automatically, this would work, but he needs a system that works with events.

Additionally, the code is to prevent abuse of the remote, rather than rule out his method entirely.

2 Likes

Are you sure this is how it works? nil isn’t something that is necessary to be stored in memory, since it’s literally nothing, so even if lua would make t[3] = 3 into {nil,nil,3}, the nils shouldn’t occupy the memory, as they are only the mark that there is no value under the keys 1 and 2, not that their value is an actual nil.

1 Like

Forgive me - I misread. :smiley:

I could be wrong, and yes you are right about how nil values obviously don’t occupy memory. It wasn’t really that it’d occupy memory, it was more-so that I remember t[1000] = 1 being effectively the same as for i = 1,999 do t[i] = nil end t[1000] = 1 internally on the C-side, making it a more CPU-intensive calculation. It was something that I distinctly remember being prevalent back in the day. You could even crash games back then by setting a high index number. But I can’t find anything on it in the documentation. I’m going to do some more digging on the subject as I’m interested now heh, perhaps I made an oopsy there. It doesn’t really make sense either way, I just somehow distinctly remember that being a thing.

At any rate, for the moment, I will say I still think it’d be better to use the Player object as that’s just a memory reference to something already in the memory. And in this case, he’d need to use game.Players:GetPlayerFromUserId which is just another calculation, although not intensive by any means, it’s still not necessary either in my opinion.

1 Like

I don’t think it does that. I just asked my friend (who reads lua source on a daily basis) and they said the same.

Moreover this code prints 0:

local t = {}

local a = os.time()
t[9e9] = 1
print(os.time() - a)
1 Like

I started thinking about this question a little more and I figured; why not just change the approach here? I find that this is backwards. Instead of the client telling the server that it’s ready to claim a reward, have the server tell the client that it’s been given a reward.

Over having the client click a button to claim a cash reward, change the logic. The server will update the cash on it’s side and then tell the client, via a remote, that they received a cash reward. The client will then display a Gui showing what cash was awarded and they can click claim. When claim is clicked, the client animates their cash value up until it reaches the appropriate goal (current + reward).

This way, it’s impossible to abuse a remote because the server isn’t taking any requests from the client. You also keep the functionality you wanted. The backend may differ but players won’t see that.

cc @NinjoOnline

3 Likes