PromptProductPurchaseFinished Vulnerability Fix

Resources Community Tutorials
#21

are u sure PromptGamePassPurchaseFinished is it vulnerable? because there is no processreceipt for gamepasses

#22

Your first sentence made me almost write a whole paragraph, then I understood that it was ironic. :skull:

#23

Get rid of it as fast as you can, you’re gonna have to find a other way to track gamepasses.

#24

It’s still a vulnerability, so it should be fixed either way.

#25

still its a vulnerability

how about gamepasses? skids can just send fake signal to server and pretend to have all gamepasses in existance (aka free stuff without paying roblox piracy??)

#26

i’ve tested this in my game and the PromptGamePassPurchaseFinished does not seems to be vulnerable, but the products was

#27

you could say that remote events fired from the client are a vulnerability. you are given tools by roblox engineers and they tell you how to use them. you cant sue a sewing machine company because you tried to hammer a nail in with it and broke the sewing machine

2 Likes
#28

You’re right, I should’nt sue the company, I should sue the sewing machine.

#29

Gamepass can be checked on the server with UserOwnsGamePassAsync from the MarketplaceService.
It’s so crazy that many people wont take time to search this thing up.

#30

it won’t work when someone buys in-game because its based on cache

however i gotta admit i don’t know if thats even true because i didn’t test it in first place

aka you need to tell your players to rejoin the game after they purchased the gamepass (and use UserOwnsGamePassAsync once player joins game)

and yes i already knew about this function

1 Like
#31

double reply: yep someone already said this

#33

Err, there’s tons of confusion here. I think you may be getting the two events twisted. ProcessReceipt is fired upon devproduct purchases, PromptProductFinished is for UI callback(s).

It’s important to note their intended usage versus going out of the way to implement unneeded checks that roblox already handles.

#34

This is true as well. It’ll require the player to rejoin for the cache to be updated, because of this there’s PromptGamepassPurchaseFinished, of course handled on the Server and using some sort of tag system indicating the user can access all game pass assets/tools.

1 Like
#35

^ yes, this is what i meant but i was joking around lol
prompt finished should be used for anything client side like loading or menus closing/ animations. processreceipt for actually handling purchases.

#36

see my point here this is stupid

you can’t handle gamepass purchases without opening vulnerabilities to exploiters

you need to tell your players to rejoin the game instead of giving the effects of that gamepass instantly (just so it can’t be exploited)

#37

Unfortunately, this is not the case; this event is fired by the client to the server and is not validated on the server by default.

1 Like
#38

gamepass is entirely safe from exploiters. its a getasync, which directly queries roblox’s databases. you are misinformed entirely

#39

please read post title thanks

the post doesn’t mention roblox databases in any way so i have no idea what the hell are you talking about

#40

Hmm, is it not possible to determine the origin of the signal with getfenv?

#41

you can’t handle gamepass purchases without opening vulnerabilities to exploiters

yes you can. gamepasses are entirely free from this vulnerability. because they are checked with an async function. which uses the inventory api.

you need to tell your players to rejoin the game instead of giving the effects of that gamepass instantly (just so it can’t be exploited)

wrong. again, userownsgamepassasync(). you dont need to make them rejoin at all.