Is there a security issue when storing user cash client side?

Hey folks.

I'm working on a cash button similar to the one in Airport Tycoon where by cash is generated for the player, the player steps on the button, and collects the cash.

The way I've implemented it is I send a SetIncrement request to increment the players cash in the cash data store. I know this is a bad idea because of rate limiting, so I've made the button inactive for 60 seconds.

Many people suggest incrementing the users cash client side and making a request every 60 seconds. But I wanted to ask if this is a security problem.

If the users cash is incremented client side and updated every 60 seconds what is stopping a hacker from modifying their cash client side so that when SetIncrement is called it updates the store with the modified amount?

The reason why I put the logic on the server side is so that the client doesn't pass any sort of value to to the server and thus can not manipulate it.

Any thoughts on this?

I would highly suggest not doing this every sixty seconds. Just simply making a value inside every player called money. Increase it when needed.

Secondly, you have the right idea. The client can modify anything client-sided, so therefore, something as important as money should be handled on a server script.