How to secure remote events from exploiters

[bytesleuth]

You can use a magnitude check where the obby ends. Players could teleport to the end to get easy money so you can check their distance each frame and if it’s above a certain threshold you can teleport them back.

[CoolDestroyer89 (cool)]

What is a magnitude check? (sorry i am not very good at scripting)

[bytesleuth]

It’s an if statement checking if the distance between two positions is smaller or equal to a threshold.
For example:

if (a - b).Magnitude <= 10 then
print("Valid")
end

[76IOOO (Array)]

Magnitude is a great way of validating remote firing for Obby as well.

I know i need to “check on the server side”, but how would i go about this? what does that mean

For example, you can check out this:

RemoteEvent.OnServerEvent:Connect(function(player, taskType)
    
    -- Validate the task was truly completed. This can be a complex or simple check.
    -- Maybe check the player's position, their game state, recent actions, etc.
    if validateTaskCompletion(player, taskType) then
        
        -- Decide the reward
        local rewardAmount = 1000  -- or determine based on task type

        -- Give the reward
        playerData[player.UserId].money += rewardAmount
    end
end)

function validateTaskCompletion(player, taskType)
    -- Your validation logic here.
    -- Example: Check if the player is in the correct location or if enough time has passed since their last task.
    return true  -- or false based on your conditions
end

[Michel2003g]

How would I secure a Hit remote

There’s an easy way to do this. A cheater can’t access already-existing local scripts. So all you need to do is give a parameter, which will be a password. and cross-reference it on the server. if the server is not receiving your password, which the cheater could never know. You just return the function and deem it unsafe.

[bytesleuth]

This is untrue, the client can access already existing scripts.

[CoolDestroyer89 (cool)]

So then what else should I do?

[imdaros]

They told you two times a good option…? Basically:

Client fires server when client reaches the end:

Server checks that client is withing X amount of studs from the end. If not the Exploiting or lag, if yes then give the money.

[CoolDestroyer89 (cool)]

Hi. I started doing this, then realized it wouldn’t work because when a player gets to then end of the obby, it teleports them to start, and shows them a gui on completion, which they click the button and it then fires the remote event. Do you know any other ways I could do it? Like should I make it so if the remote event is fired off too many times in a certain time frame the player is kicked/banned?

[Fimutsuu (Fimutsu)]

when you touch a part in the end change a boolvalue inside the player to true
something like ReachedEnd.Value = true the script needs to be a server script
when you send the remote make the server check if the value is true

[CoolDestroyer89 (cool)]

couldnt the exploiter just fire off the “reached end” remote event so they can fire off the actual ones?

[bytesleuth]

Why don’t you just fire another remote when they get to the end before teleporting? Then you can save a variable on the server saying they completed it with the magnitude check, and in the other remote you just check if that variable is true.

[Fimutsuu (Fimutsu)]

there is no reached end remote i never said that.

[Youtub5005 (Boss)]

.Touched Question's and Security Concerns

checking the magnitude of the HumanoidRootPart can be exploited because the client has network ownership of there character so they are able to position there character anywhere they like can exploiters fire remote events / functions = yes can exploiters position there character anywhere they want to = yes can exploiters fire touch events in a server script = yes here are some videos that might help [Stop Hackers / Exploiters - Roblox Scripting Tutorial…

@5uphi provided an insightful response to a topic similar to this and provided 2 videos that go over Exploit Security and Replication that I recommend you give a watch

[hya123456h (KingBob)]

I would try making say a code then on the server you can run a calculation to check if that code is a certain number e.g Client Send 4566564324354, Server times by 0.5 then divides 100 . If it is not the set value then kick the player

[DasKairo (Cairo)]

@bytesleuth

This is hard to answer without context, every case scenario can be different.

How? There is nothing Different about any exploitation of a RemoteEvent, and all of them have the Same solution. Which is “Sanity Checks”, the context does not matter here if the solution will be the exact same.

---

Sanity Checks are basically juat validating the info, to make sure its true, with RemoteEvents of any kind going towards the Server, it is always best to assume what the client sends is completely false, as it can be manipulated by it.

[bytesleuth]

What I meant was every sanity check can be different.

[CoolDestroyer89 (cool)]

Hello. I am trying to make it so that if the event is fired twice within one minute, it kicks the player.

It doesn’t work, do you know what the issue is?

[bytesleuth]

local PlayerLastRecievedTimeMap = {}

game.ReplicatedStorage.Quests.Hundred.OnServerEvent:Connect(function(player)
	if PlayerLastRecievedTimeMap[player] and (os.time() - PlayerLastRecievedTimeMap[player]) < 5 then
		player:Kick("Quest completed too fast")
	else
		PlayerLastRecievedTimeMap[player] = os.time()
		player.leaderstats.FairyDust.Value += 100
	end
end)