Limbs Twisting and Major Lag DDos / Bizarre Exploit/Bug

[EviLizBun (EviLiz)]

Hi there, I own this game on Roblox and me and my team have been encountering an insane issue. Randomly, every rigs limbs in random directions and the server gets INCREDIBLY slow. I don’t know if this is an exploit attack or a bug as this has happened to every public server.

[Laqotaa (Laqota)]

Holy moly, it’s blockbears! I remember playing that a long time ago. HOR HOR HOR HOR HOR

I think the only people right now that could even debug the game is your development team. I doubt you want to dump all your hard-work and source code here.

1. I would look at Memory Tab and make sure you Select Server. LuaHeap, Script, PlaceScriptMemory would be great places to look.
2. You should also look at the Scripts tab, here you can see how much activity for each script.
3. You can also look at ServerStats tab, and it will show you like Ping and Data being sent out to all players. For the way your game plays, it feels like the server itself is physics/Data throttling. Look at Total Physics and Avg Physics Sender in ServerStats, as well as the Ping and Total Data KB/s.

The whole game is incredibly laggy, even in private servers. I think the thing happening to you might be a bug related to Server Rendering because it’s prob throttling like crazy.

Warning About Loops

Throughout your game, you should try to use game:GetService(“RunService”).Stepped or game:GetService(“RunService”).Heartbeat, and using Tick() as a delay instead of a million While Loops. They automatically throttle during Server Rendering.
While true do loops do not throttle whatsoever and yield scripts since it takes all resources. task.spawn is also not good practice unless really needed.

You should also be trying to not use a hundred loops throughout the game. Try to minimize them and stick them in a single loop IF POSSIBLE. You may need to do a lot to do that, though.

Stepped is good for immediate loops.
Heartbeat is good for loops that are fine to throttle during really laggy conditions.

local Construct = {
    SteppedDelay = 0;
}
local RunService = game:GetService("RunService")

RunService.Heartbeat:Connect(function()
    if Construct.SteppedDelay <= DateTime.now().UnixTimestampMillis then
        print("I am printed every second")
        Construct.SteppedDelay = DateTime.now().UnixTimestampMillis + 1000
    end
end)

Warning about Script Stacking

What do I mean by Script Stacking? I mean a whole model with one script for a door opening and closing and another script for the button to make a BoolValue true or false. If it is at all possible for you, try to minimize scripts in a Module and use Object Oriented Programming to register buttons to a function, in a single script.

EXAMPLE

--!This is a Module Script
local button = {}
button.__index = button

function button.register(buttonmodel : PVInstance, callback : Function)
	local self = {
		Model = buttonmodel;
		Callback = callback;
		ClickDetector = buttonmodel.Button.ClickDetector;
		ClickTrigger = nil;
		lastPlayer = nil;
	}
	self.ClickDetector.MouseButton1Click:Connect(function(player)
		self.lastPlayer = player
		self:playClickAnimation()
		self.Callback(player)
	end);	
	return setmetatable(self,button)
end

function button:getLastClicker() --External Function for some weird use, idk. Just an example.
	return self.lastPlayer
end

function button:playClickAnimation()
	--Animation stuff
end

return button

--!This is a Server Script
local ButtonModule = require(script.ButtonModule)

local b1 = ButtonModule.register(script.Parent.Button1, bro1)
local b2 = ButtonModule.register(script.Parent.Button2, bro2)
local b3 = ButtonModule.register(script.Parent.Button3, bro3)

function bro1(plr)
    print("I am bro1 💪")
end

function bro2(plr)
    print("I am bro2 🦾")
end

function bro3(plr)
    print("I am The Ultimate bro, bro3 🦾🤓🦾")
end

Much better.

Although this wouldn’t really cause HUGE performance improvements. It’s really good practice, hence, I suggested it.

Warning about Scripted Animations, effects, etc.

If you have any scripted CFrame animations (like tweens) or effects, etc. I would highly recommend finding a way to have it be sent over a Remote to have it play on all clients. This is a huge part of optimizing networking. I’ve always had this mindset.

1. NEVER TRUST THE CLIENT, EVER EVER EVER EVER EVER EVER EVER EVER EVER EVER EVER. EVER.
2. You can trust the client to play CFrame Animations and Tweens. Since if they do try to modify them, it will only affect them.
3. You can make one remote that gives everyone admin just for fun (dont do this)

You may make sure that the remote that you’re using to replicate the limb movement to the Server and to other players isn’t just loosey goosey and any player can just mention you in the event and move your limbs. Add a .1 delay and also use UnreliableRemoteEvents Since this is just a detail it isn’t strict that the client MUST reach the server. This will improve performance A LOT I bet.

Warning about Raycasts, casts of any kind.

Raycasts are incredibly unoptimized. Here are some good tips to make sure you aren’t using them too much.

1. Always have a delay with Raycasts in a loop. You should never be constantly, every tick, firing a Raycast.
2. If it’s ever possible for your situation. Find any way to avoid expensive, long distanced rays. Try to make them as short as you possibly can.
3. Avoid Ray Stacking whenever possible. Aka, firing a ray at 90/45 degree intervals around the character. Especially if you have a huge max player count.

Ending

I hope you find it out and that this helped you a little bit.

EDIT: Side note, I’m not sure if it’s just me but I’m too easy at finding bugs. I clicked humans, clicked back and clicked animatronics and now I’m hard-locked on a black screen..
EDIT 2: Just made it look better and explained it a lot better.

[RuinedSanctuary]

yeah so you probably have a limb replication script, I recommend checking who fired it on the server and if it’s not equal to the character that’s being replicated then kick the player.

[EviLizBun (EviLiz)]

Hey thank you for your help, we’ve figured everything out and patched the exploit!

Edit: The issue was that we had a “stare” script which allowed your head to stare at the closest camera object, problem is that it could be easily exploitable and it was making every single player’s limbs stare at the closest camera, resulting in server wide lag.

[Laqotaa (Laqota)]

Kinda crazy that it was actually an exploit. I was just generally lagging in every server I played in it seems like.

[deIuxor]

@Laqotaa

NEVER TRUST THE CLIENT, EVER EVER EVER EVER EVER EVER EVER EVER EVER EVER EVER. EVE

Hey there! I’m the villain transcending exploiters worst fears and making it possible to trust the client

Helpful Anti Cheat V4

[Laqotaa (Laqota)]

Ah yes. Don’t trust the client but trust the client with… Another script.

If you have anything to say. Say it in my DMs