Should I add a sanity check or just redo this remote

[Er3mielQ (Er3)]

I made a remoteevent that fires when a user presses a button in a point shop alongside two variables. The first variable was the ‘merit’ which is just how much their ‘Increased’ or ‘Decreased’ value in leaderstats change by, and the ‘pointCost’ variable which is just how much the button costs.

Each button (+1, +5, -5, etc.) has a localscript that runs the function (Image 2)

(Image 2)

The remote event script is as follows

Except because I opted for convenience with the variables, people could run the event on their client as game.ReplicatedStorage.Remotes.shopPurchase:FireServer("+1000000", 1) to add 1 million leaderstats value while only paying 1 point. I’m not sure what kind of check I could do to prevent this since it’s not like I can just check their value since they are able to modify it in the event.

[SeargentAUS (Seargent)]

You should probably redo it, at least partially.

Don’t trust the client for the costs - have some other place that it is stored which the server can access. Just have the client tell the name of the item (or the merit in this case) to the server, with which the server can determine the price.

[Er3mielQ (Er3)]

Yea I can’t brain right now so I’m just gonna have it strictly outlined in the server script like this so if a change is detected I can just kick them or whatever.

Probably a better way to do this but oh well at least this way they cant change it

[player14141414141414 (tootpopper69)]

reading this made me think… should i kick a player if their xp/cash value is not the same as the server? i haven’t included a client amount to be sent to the server but it could be quickly added. but is it a good idea?

[Seftube]

Doesn’t sound like a good idea. If there is a discrepancy you should simply just update it for the client as there is a lot that can go wrong with a system like that.

[SeargentAUS (Seargent)]

Yeah, there is an easier way to do this:

local prices = {
	["+1"] = 2,
	["+5"] = 10,
	["+10"] = 15,
	["+15"] = 20,
	["+20"] = 30,
	["+50"] = 50,
	["+100"] = 95,
	["+200"] = 180 
}

game.ReplicatedStorage.Remotes.shopPurchase.OnServerEvent:Connect(function(plr, merit, price)
	if kPoints.Value >= price and prices[merit] == price then
		-- do thing
		local amount = tonumber(string.sub(merit, 2))
		print(`added {amount}`)
	end
end)

[Er3mielQ (Er3)]

Yea I’ll reformat mine when I get back to it. Thanks.