I made a remoteevent that fires when a user presses a button in a point shop alongside two variables. The first variable was the ‘merit’ which is just how much their ‘Increased’ or ‘Decreased’ value in leaderstats change by, and the ‘pointCost’ variable which is just how much the button costs.
Except because I opted for convenience with the variables, people could run the event on their client as game.ReplicatedStorage.Remotes.shopPurchase:FireServer("+1000000", 1) to add 1 million leaderstats value while only paying 1 point. I’m not sure what kind of check I could do to prevent this since it’s not like I can just check their value since they are able to modify it in the event.
Don’t trust the client for the costs - have some other place that it is stored which the server can access. Just have the client tell the name of the item (or the merit in this case) to the server, with which the server can determine the price.
Yea I can’t brain right now so I’m just gonna have it strictly outlined in the server script like this so if a change is detected I can just kick them or whatever.
reading this made me think… should i kick a player if their xp/cash value is not the same as the server? i haven’t included a client amount to be sent to the server but it could be quickly added. but is it a good idea?
Doesn’t sound like a good idea. If there is a discrepancy you should simply just update it for the client as there is a lot that can go wrong with a system like that.