PromptProductPurchaseFinished Vulnerability Fix

Resources Community Tutorials
#42

As the documentation states; the UserOwnsGamepassAsync API caches and doesn’t update the result if a player purchases the gamepass while in-experience.

Screenshot_20240708_223639_Chrome
Screenshot_20240708_223639_Chrome720×708 186 KB

2 Likes
#43

Is this vulnerability fixed for PromptGamePassPurchaseFinished?

#44

I believe it (kinda) is, though if you don’t have proper checks, exploiters can still call it multiple times and get ingame rewards multiple times. (if you reward then via PromptGamePassPurchaseFinished)

#45

How would you perform proper checks?
You can’t really use UserOwnsGamePassAsync because of its caching behavior.

#46

Why would you use promptproductpurchasefinished though? Handling devproducts is meant to be in a callback function with processreceipt.

#47

Is there any way to safely listen to assets and bundles purchases? as ProcessRecepit only works for developer products. :man_facepalming:

EDIT:
Probably forced to use, PlayerOwnsAsset and PlayerOwnsBundle few seconds later… kinda sucks ngl.

EDIT 2:
Also have to check if the user already bought it or once purchased they can spam and cheat it.