Will the player ALWAYS be the first parameter when firing a remote event from the client?

Help and Feedback Scripting Support
#1

This may seem like a silly question as the article for Remote Events states that the first parameter is the player, I want to be extra sure with this “anti cheat script” I’m about to make for my game

My Goal is to punish players for “tab holding” or “X-Holding” which is where pc players can hold their roblox window to freeze their character and client
(Here’s the topic for it if your still confused what X Holding is)

You see when players do this, it literally freezes their character so for example a damage script like this :

script.Parent.Touch:Connect(function(hit)
    if hit.Parent:FindFirstChild(“Humanoid”) then
        hit.Parent.Humanoid.Health -= 3
    end
end)

Would not fire causing the player to not get damaged.

This is bad for my game which is Bullet Hell Survival where the objective is to survive and not die. By X-Holding you can just afk through the entire game and not take damage.

——————————————————————————————————————
Now what does Remote Events have to do with this? I’ll explain.
In my game you get Points for winning a level, so the punishment I’ve come up with is simply reseting the players point to BEFORE they started X-Holding

Example of situation :
player has 100 points
wins 100 points for X-Holding (now has total of 200 Points)
Game detects X-Holding and fires the remote event which resets player points back to beginning (100 Points)
——————————————————————————————————————

I REALLY DO NOT want exploiters to fire this remote event to cause other players to have their points reset
The line that is going to fire the event from the local script is this

local Event = game.ReplocatedStorage.XHoldEvent
Event:FireServer()

I’m not putting any parameters because I know exploiters can mess with these, but the question is can they mess with the player parameter??

#2

Yes, the player will always be the first argument.

#3

But can exploiters edit the player argument?

For example instead of :FireServer() sending the exploiters player instance, could the exploiters edit it so it sends a different player instance?

#4

No since that would require customising FireServer's internal definition itself (which isn’t possible).

1 Like