There's no safe way to grant rewards for gamepasses bought in-game

[aaron_mccoy (PleaseDontBanAaron)]

Big Edit:
I have unknowingly spread misinformation by my lack of research into this topic. I cannot delete it, so I will leave it strike-throughed so hopefully I don’t cause anymore confusion

As a Roblox developer, it is currently impossible to safely grant rewards to a player for a gamepass they have just purchased in-game.

Normally this is done by using the API: PromptGamepassPurchasedFinished to detect in-game purchases and grant rewards.

However, it has been revealed by other users that this API can be spoofed to unlock all gamepasses for free, making it unreliable.

Feedback on "Passes"

EDIT: Below post was based on misinterpretations of Roblox’ inner workings. The only risk PromptGamePassPurchaseFinished has is being able to re-trigger the signal. Read more Original post: It is possible to fire PromptGamePassPurchaseFinished from the client-side (eg. using exploits). See: https://devforum.roblox.com/t/wyvern-leaked-roblox-security-awareness/2944681/1 Further clarification: Feedback on "Passes" - #3 by xChris_vC The script in “Example Server-Side Script” opens…

⠀

The only other method is the API: UsersOwnGamepassAsync, but unfortunately the documentation explains that due to its caching behavior, it would not provide a reliable result:

> If the pass is purchased in-experience through PromptGamePassPurchase(), this function may return false due to the caching behavior.

⠀

The main ways of solving this would be one of the following:
1. The caching behaviour needs to be removed for UserOwnsGamePassAsync so that the developers can cache on their own end
2. A new API to reliably detect Gamepass ownership without being spoofed
3. Make it so PromptGamepassPurchasedFinished can’t be spoofed by the client

This bug report has been heavily based on this existing feature request by Chipio

It's impossible to safely grant rewards for gamepasses bought in-game

As a Roblox developer, it is currently impossible to safely grant rewards to a player for a gamepass they have just purchased in-game. Historically, developers have used PromptGamePassPurchaseFinished to detect in-game pass purchases and grant rewards. However, it has been revealed that clients may be able to spoof this event and theoretically unlock every gamepass in the game for free, making this event unsafe to rely upon. Ideally this could be fixed with a simple safety check with UserOwnsG…

[bvetterdays (roman)]

Did you miss these replies to your feature request?

It's impossible to safely grant rewards for gamepasses bought in-game

The issue you’re presenting here is not quite what you think it is. Users cannot spoof their purchased state if they do not own the gamepass. They can, however, fire the listed PromptGamePassPurchaseFinished event multiple times with successful arguments for a gamepass they already own. There’s no restriction on this, it’s been known about for a very long time, and it’s why this notice is provided within its documentation: To avoid duplicate item grants, store the purchase in a data store. If…

It's impossible to safely grant rewards for gamepasses bought in-game

The inventory-checking code using RoProxy isn’t actually necessary because as (vaguely) stated here, Roblox does do a server-sided backend check of the gamepass ID you’re firing to PromptGamePassPurchaseFinished to ensure you actually own it before firing the event for it: The only issue is it can be fired multiple times by exploiters who own it. I’ve actually verified this behavior myself and confirmed it through talks with an engineer.

[xChris_vC (Chris)]

@aaron_mccoy

However, it has been revealed by other users that this API can be spoofed to unlock all gamepasses for free, making it unreliable.

I have heard later on that the gamepass purchase signal will not be fired if the player doesn’t have the gamepass.

The exploit that was being discussed at that time was firing multiple devproducts signals, which was a developer-introduced vulnerability by trusting the PromptPurchaseFinished signal for awarding rewards.

I’ll update my posts to avoid any misconception in the future.

[archang3l289]

Thanks for the report. As you pointed out, using PromptPurchaseFinished isn’t the correct signal to reward users. The right way to reward user is via ProcessReceipt API. We do not plan to change this behavior.