What are some good sanity check methods for my damage remote event?

[AK47xM16]

I made a simple projectile system that goes from client → server → client → then back to the server to deal damage, but the problem is that I know that exploiters can just fire this remote event for everyone, so it will be like a kill all script. What sanity check methods would prevent this?

[dthecoolest]

This post by @orange451 has a lot of good in-depth tips and checks for an FPS if you are prioritizing client experience.

Secure Yet Accurate Gun Raycasting?

This is a problem I tackled in my shooter. I employed a bunch of different methods to try to minimize the amount people can cheat through the gun system. The main problem is the client needs to be given a lot of control for shooting in a FPS, or you’ll run into ugly response times. One of the main ways I check for this is through a cone-of-fire check. I keep track of where the player is looking (a vector direction value). Whenever they shoot the gun, and the server receives their shoot reque…

[AK47xM16]

I really like the cone method and I will definitely apply it to my game, but however, I didn’t see anything that said about spamming the damage remote events.

[dthecoolest]

Hmm, well that’s another issue which I believe should be solvable using this neat resource I found which prevents remotes from being spammed.

Rate limiter module for Remotes

Hello there! Exploiters often try to spam your remotes to see if they exceed the limit the server can handle and causing it to crash. In general, it is good practice to limit the rate of your remotes to prevent that behavior. This module should make this process very easy for you. What it does: This module I made allows you to easily set a maximum request rate for your RemoteEvents or RemoteFunctions. With this module, you can simply ignore requests if your set maximum rate is exceeded by the…

[AK47xM16]

That module doesn’t work for my purpose, but I will find some other way for that one problem. Thanks for these resources, couldn’t find them anywhere.

[orange451]

If your gun information is defined in an area where both the client and server can view it, then you could store your guns “RPM” value there as well. That way when damage requests are being sent from the client to the server, you can verify that they aren’t violating your guns RPM (obviously within a given threshold to account for client lag/inconsistent network connection).

This is something that I do in my gun system and it works quite well.

Another trick I employ is to assign each bullet a unique identifier. On the server I track how many damage requests are allowed for a given identifier (assault rifles/pistols get 1 damage request per bullet. Shotguns get 12, for example). If the client sends more damage requests for a given bullet identifier than the the server permits, then their damage requests will be ignored for that bullet.