Hello, let me describe my system: I have a shop system that sells weapons for coins and Robux. The price of the weapons is retrieved from a module script, and it depends on the name of the button. I’m using a server script to check the user’s coin amount and then subtract the price (which I get from the module script). Is this method safe, or is there a more secure way to implement this to avoid potential backdoors?
2 Likes
Using the button’s name as an identifier is unsafe, because exploiters can change it on the client to purchase any item, including unreleased or limited ones. I would assign a unique ID to each weapon and send that ID to the server when purchasing. On the server, you should verify that the weapon exists, the player has access to it, and that the player is near the shop before completing the purchase.
Yeah, probably dont use the buttons name, as @Pumpkin_Spicce mentioned.
I would personally create a server sided folder that stores the prices as intvalues, since these should be safe. Correct me if im wrong tho
1 Like
I disagree with this. As long as the name is unique from other buttons, there’s no difference between the name and an ID, because an exploiter can send whatever ID they want to the server anyway. The only way to really confirm that the player can buy the weapon is by checking on the server, as you said.
3 Likes
That does work, but there is no benefit to creating an IntValue for each price value. The best approach would be to store all data (name, price, etc.) in a module under ReplicatedStorage. As long as you do sufficient server checks as others have mentioned it should be safe from exploiters.
1 Like
Ok thanks for letting me know 
IDs are superior overall, especially if the shop is complex or contains limited weapons. If no one knows the ID, they won’t try to exploit it, and renaming the weapon or making other changes won’t affect the ID.
I’m pretty sure the exploiter can read any script that’s running, so they know all the IDs anyway because they can read the localscript that sends the ID to the server.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.