PromptProductPurchaseFinished Vulnerability Fix

Resources Community Tutorials
#43

Is this vulnerability fixed for PromptGamePassPurchaseFinished?

#44

I believe it (kinda) is, though if you donā€™t have proper checks, exploiters can still call it multiple times and get ingame rewards multiple times. (if you reward then via PromptGamePassPurchaseFinished)

#45

How would you perform proper checks?
You canā€™t really use UserOwnsGamePassAsync because of its caching behavior.

#46

Why would you use promptproductpurchasefinished though? Handling devproducts is meant to be in a callback function with processreceipt.

#47

Is there any way to safely listen to assets and bundles purchases? as ProcessRecepit only works for developer products. :man_facepalming:

EDIT:
Probably forced to use, PlayerOwnsAsset and PlayerOwnsBundle few seconds laterā€¦ kinda sucks ngl.

EDIT 2:
Also have to check if the user already bought it or once purchased they can spam and cheat it.

#48

image
image613Ɨ958 101 KB

This image best describes how vulernable PromptPurchaseFinsihed and PromptGamePassPurchaseFinished can be. As the poster of this X post states, you can continuously fire the isPurchased parameter with true if you own the asset/gamepass. The only way to prevent this is like what the author says, use checks beforehand, Iā€™ve used the roblox inventory API with a proxy due to the limitations of PlayerOwnsAsset (does not return every copy of an asset a player owns, ex. collectible limited, ugc limited)

1 Like