game-security-pitfalls

Game Security Pitfalls

Overview

Everything in the client — memory, files, packets — belongs to the player. That makes most single-player cheating a non-finding (attacker and victim are the same person) and makes everything that affects other players or real money a real one: multiplayer outcomes, leaderboards, trading, purchases, shared content.

Core principle: clients send intent ("move north", "fire toward x"), the server decides outcomes ("hit for 37"). Any message that carries an outcome is a finding when other players depend on it.

1. Server Authority (CWE-602)

// ❌ Unity Netcode for GameObjects: any client can call it, and it reports the result
[ServerRpc(RequireOwnership = false)]
void ApplyDamageServerRpc(ulong targetId, int damage) { players[targetId].Health -= damage; }

// ✅ the client sends intent; the server checks the sender and computes the outcome
[Rpc(SendTo.Server)]
void FireRpc(Vector3 direction, RpcParams rpcParams = default) {
    var shooter = PlayerFor(rpcParams.Receive.SenderClientId);
    if (!shooter.CanFire()) return;
    weapons.ResolveShot(shooter, direction.normalized);
}

# ❌ Godot: any peer may call it and claim any score
@rpc("any_peer")
func submit_score(player_id: int, score: int) -> void:
    scores[player_id] = score

# ✅ identity from the transport, outcome from server state
@rpc("any_peer", "reliable")
func request_finish_level() -> void:
    var id := multiplayer.get_remote_sender_id()
    scores[id] = compute_score(id)

// ❌ Unreal: the validation function accepts everything
bool AMyCharacter::ServerSetHealth_Validate(float NewHealth) { return true; }
// ✅ no client-settable health; server RPCs carry inputs and validate ranges
bool AMyCharacter::ServerUseItem_Validate(int32 Slot) { return Slot >= 0 && Slot < Inventory.Num(); }

Also: Mirror [Command(requiresAuthority = false)] acting on objects the caller does not own; a client-authoritative transform with no server-side speed or teleport check in a competitive mode.