Scripting HelpersARCHIVE
A little piece of Roblox history. Preserved for everyone, one question at a time.Read about the archive →
✓ ANSWER ACCEPTED

Will this protect my remotes from exploiters?

I've been thinking of a way to protect my remotes and I'm not sure if this will do? I made it so it requires a password which changes every second for it to actually fire.

Password Change

while true do
	wait()
	math.randomseed(tick()%1*1e6)
	local pass = ""
	for i = 1,32, 1 do
		pass = pass .. string.char(math.random(97,122))
	end
	
	script.Pass.Value = pass

end

Part of the local script for firing remote

game.ReplicatedStorage.Events.Convert:FireServer
(game.ServerScriptService.RemoteProtection.Pass.Value)

end

Part of the script for getting the change

game.ReplicatedStorage.Events.Convert.OnServerEvent:connect
(function(Player,Pass)

print(Pass)
if Pass == script.Parent.Parent.RemoteProtection.Pass.Value then
print("yes this was sent from server")

1 comment

0

I just have set up listeners that have a parameter what it wants to do. You could do that.

2 answers

✓ Accepted answer

Yes, it will protect them from exploiters because exploiters can't access SeverScriptService.

2 comments

0

Im a genius

0

Yes, you are.

No, for two reasons:

  1. Your local script is attempting to access game.ServerScriptService, which it won't have access to (that only exists on the server). If you are testing this in Roblox Studio by running the place, you won't notice this because you act as both server and client simultaneously. (Try the Test Mode where it opens up a server and player in separate windows and then it'll error.)
  2. Anything your local scripts can do an exploiter can also theoretically do. They can run any arbitrary piece of code (and may be able to read any scripts that are loaded onto their client), so they can simply copy/paste your script (assuming you get it to work) and then modify it however they want.

To create code that is exploit-proof, assume that exploiters have complete control over their client and can send you anything they like and make sure that no matter what they send to the server, your game won't break. Some guidelines:

  • Don't offer RemoteEvents that give exploiters freedom. ex, if you provide a SetMoney RemoteEvent, they can simply call SetMoney(10000000) and become rich instantly. Instead, provide a BuyTool RemoteEvent which changes the money on the server and then notifies the client about the changes (both to their money and tools available).
  • Always check to make sure the arguments are exactly what you expect. Ex, in that BuyTool RemoteEvent, you might expect the name of the tool they are buying. But what if the exploiter sends in a tool that doesn't exist, or a number, a reference to the workspace, or nil? In other words, make sure each argument is the type you expect. If not, you either have a bug in your local scripts or you might have found an exploiter.
  • You might check to make sure that your functions aren't being fired a ridiculous number of times by the same player. ex, if you can guarantee that you never call your RemoteFunctions more than 100x/sec and one or more of your RemoteFunctions are being called a total of 1000x/sec, you might safely conclude that the user is an exploiter (again, unless you have a bug somewhere).

1 comment

0

Your first guideline example is confusing. Where is the solution to setting the money?

This discussion is preserved as it was. New answers, comments, and votes are closed.