So I have a damage script in ServerScriptServices. It's parameters are the player and it's damage.
The reason I have "none" as the first parameter is because I'm trying to damage another player not myself
damageEvent.OnServerEvent:Connect(function(none,player,dmg)
--does damage stuff
end)
Would an exploiter be able to fire the healthEvent from an local script and damage any player they want with this? If so how do I make it more secure?
An exploiter can easily spawn kill every player in the server by:
for i, v in pairs(game:GetService("Players"):GetPlayers()) do
damageEvent:FireServer(v, math.huge)
end
You should do all the damages on the server, no remotes. Alternatively, you could do
damageEvent.OnServerEvent:Connect(function(player,dmg)
--does damage stuff
end)
which would only the damage the player itself.
This discussion is preserved as it was. New answers, comments, and votes are closed.
3 comments
Yeah an exploiter could probably fire this 1000 times in a row
How would I make a damage script that isn't abusable by exploiters? Since they always have to fire the client to know who they're attacking how is it possible to prevent abuse?
it's based off of your game mechanics, if you have fights with max 2 people, you can make sure that person he damages is his enemy, next you would create a small debounce based off of the situation again. The best option is always to do stuff like this on server.