This is risky to do without server-side simulation or checks due to exploiters, and since this game style would be otherwise pretty much impervious to exploits, it would be a shame to open up basically the entire combat framework to exploits. What you’re looking for here is lag compensation. Here and here are great articles on it from valve. I think a combination of client-sided movement prediction and latency compensation for hits would make the game smooth while having minimal hitreg issues from the client’s perspective. My game prototype currently uses PlayerPing to do this, which has turned out to be extremely precise from experience, and is supposedly very secure and exploit-proof.
I think servers are more powerful than you give them credit for. The server shouldn’t be a bottleneck at all, especially if you’re using simplified hitboxes instead of exact geometry for hit detection. Basically every game with damage or collisions in it needs a hitbox system, and they don’t have lag issues due to hitboxes.
If you simulate the hit events on the server (which should take a really tiny amt of time anyways), then it shouldn’t be exploitable other than the client sending wrong hit types or new hits or when they shouldn’t, which can be checked fairly quickly (if they could physically make the hit, if the cooldown has passed, can they make that move, does it match up with server simulation, etc).