May exploiters call the PromptProductPurchaseFinished event and so on?

[Daeny1000 (Daeny)]

Yes, I’m just curious, since there was an incident in my game where a random player donates to the game about 9 times in less than 2 seconds:

It’s like impossible for a simple player without exploits. And i think, this is not server-side problem since the script itself is fine:

MarketPlaceService.PromptProductPurchaseFinished:Connect(function(UserId,Id,Purchased)
	if Purchased == true then
		for i,v in pairs(Donations) do
			if Id==v then
				local plr = game.Players:GetPlayerByUserId(UserId)
				local Product = MarketPlaceService:GetProductInfo(Id,Enum.InfoType.Product).PriceInRobux
				ReplicatedStorage.Game.Events.Client.Chat.SendMessage:FireAllClients("[System] " ..plr.DisplayName .. " (@".. plr.Name ..") donated " .. Product .. " robux, thank you!")
				break
			end
		end
	end

And yeah, i’ve checked group funds (my game in group) and there’s nothing.

If exploiters can do this, how would i avoid it?

[FroDev1002 (FroDev)]

they could just be firing the event multiple times without actually triggering the PromptProductPurchaseFinished function

[12345koip]

I’ve heard about a Roblox vulnerability where exploiters can call the MarketplaceService’s function to signal a product prompt purchase finished won’t say it here. This should be limited to Roblox core scripts, and if you try to run it in Studio, you get an error.

Roblox recommends not to use PromptProductPurchaseFinished to detect purchase finishes anyway, you should use ProcessReceipt for that, which also does not include this vulnerability.