Would client-side damage be a security issue for PvE game?

When looking for optimization for NPCs, I found Suphi’s method where the server stores the data of NPCs and renders NPCs on client, but the issue is my gun system does server-side damage to the NPCs and it doesn’t work on the client-side NPCs.

The old optimization I made was creating NPCs on the server, but the client would handle pathfinding, effects and whatnot and it worked by setting the networkOwner to the NPC’s player target which allowed for this server-side damage system to work but at the cost of high receive rates even if there were only 30 NPCs (about 40 KB/s).

Now , my solution is to make the damage dealing happen on the client, once the NPC’s client health reaches 0, send a signal to the server to destroy the data of the NPC and finally delete the NPC on the client; Would this be security issue even if it is a PvE game?

Extra info:
The client pathfinding using SimplePath and gets the client NPC through CollectionService and updates when the server data changes

the models are client-side
the configurations store the position data

If i were to add health to it, do not know how I would access the individual client NPC model to kill itself

2 Likes

Obviously, don’t handle stuff on client. The server handles data, so why shouldn’t it handle Health aswell?

I can’t seem to figure out how to access the health of the NPCs, because the position data doesn’t need to know the actual NPC object, it’ll just update in the NPC loop

Attributes? Deal the damage on the server by changing a Health attribute?

I can’t access the attribute as I cannot pinpoint which NPC was damaged, even if they both have the same name as the zombie, if I do
Enemies:FindFirstChild(zombie):SetAttribute(health, health-damage)
It would be gambling on which zombie was hit

If i looped thru the data and compared the health to the others, it would be faulty cause what if another NPC was damaged at the same time or what if the NPC’s health was different than the others

Multiple problems to be solved here in this post.

Use an ID system using GUID or a basic numerical ID += 1.

Have you seen this post? Should be some good tips for mass npcs.

1 Like

Yes, though I’m using AttributeChanged for mine; I understood more in Suphi’s tutorial. I’ll try the ID system, and the good news is that with this system the KB/s is just 2 KB/s at 800 NPCs which is enough for my game

Thank you for the ID system idea, though it was hard to visualise properly, I have managed to make the system viable, the zombies can smoothly run even at 800 NPCs, it actually can render up to 1500 but then the script won’t make them move because there’s a lot, the average KB/s is 2-4KB/s which is amazing; I have also made it so that it makes zombies outside a radius disappear to save memory and the pathfinding works properly! -not that well cause it’s roblox pathfinding but I’m not that smart to make my own pathfinding yet

Now i just have to revamp the weapon system, I’ll keep the post updated.

Since my system is wave based here’s how it works:

Wait for new wave change > Server set ups attributes for server data > FireAllClients > Set up ID for client and create zombies > client handles pathfinding and effects > server updates position attribute to player’s position/dealing damage to player

1 Like

everything is starting to click together

update: didn’t click together

Alright after experimenting a lot and going over impostor syndrome, the solution to my problem was to use Parallel Luau for the NPCs.

Why? Well because I could not understand or adapt around the client replicated NPCs for their attacks, registering players shooting them and because of a syncing issue between all the clients, though this method would work for another kind of game. Another reason why I used Parallel Luau and still used the SetNetworkOwner method is because the client replication system could not work with the systems I already have in my game, which would solve the original problem of not being able to register hits.

Finally the bandwidth was 40 kb/s sent if there were 100+ NPCs and 3-6 KB/s received for any number of NPCs. Considering the game is based on a wave structure, I think the bandwidth will still be under 40 kb/s sent

Thanks to those who sent their solutions :gift_heart: