Scripting Helpers is winding down operations and is now read-only. More info→
Ad
Log in to vote
0

Is it safe returning things, can the exploiter edit things that are returned by the return function?

Asked by
I_UseAltAndVpn 47
4 years ago
Edited 4 years ago

So I have a remote function that returns a players data and I was wondering if the exploiter could somehow tamper with it

heres how it looks like



return PlayerData -- a Table of Data Cash, .. Currency ETC
0
An exploiter can always tamper with the data it is given on its own end. As long as you're not allowing the exploiter to tamper with the data on the server's end and do some form of validation to assure the server modifications are legitimate, you should be in the clear. M39a9am3R 3210 — 4y
0
But I was wondering if they could change the return thing like for example lets say theres a intvalue on the serverside and i returned it would they be able to change the int value in the server side? somehow I_UseAltAndVpn 47 — 4y
0
I think exploiters can't do that RadiatedExodus 41 — 4y

1 answer

Log in to vote
0
Answered by
RubenKan 3615 Moderation Voter Administrator Community Moderator
4 years ago
Edited 4 years ago

Anything the client changes will only be changed for the client (Except for their own humanoid).

But in client to server remote events (which is :FireServer(Args)) any argument can be exploited/changed to their liking. Same goes for RemoteFunctions, they can tamper with what the client returns to the server.

Anything the server sends (in events) to the client can't be altered directly, but they can however, disable (or remove) the scripts that handle the event (or ui / tools, etc), so that it doesnt do anything. (This is pretty bad with RemoteFunctions as they'll yield till they get a response, or a decently long timeout that you cant change yourself)

So yes, the client can technically change the variables that they get from a remote event; not directly, but simply by changing the things that the event would normaly change.

Always keep in mind: Anything from the client can be fake. Always secure remote events.

Ad

Answer this question