anti-cheat

anti-cheat

Core Philosophy

In multiplayer games, the client is fundamentally compromised. The game executable runs in a hostile environment controlled by the user: memory can be modified via Cheat Engine, network packets can be intercepted, and GPU rendering pipelines can be injected with custom shaders. True anti-cheat engineering does not rely on invasive kernel drivers alone; it is built on an uncompromising architectural foundation: Server Authority. The client only sends input intentions; the authoritative server simulates physics, validates mechanics, and adjudicates reality.

4-Step Server-Authoritative Anti-Cheat Architecture

Step 1: Server Authority & Movement Validation

1. Never Trust Client Coordinates:
   • The client must never send absolute positional updates (player.position = x, y, z).
   • The client sends raw input vectors (Move forward, Jump, Delta time). The server simulates physics and returns authoritative state.
2. Speed-Hack & Teleportation Prevention:
   • Server tracks positional displacement per tick: $$\Delta d \le v_{text{max}} imes \Delta t + \epsilon_{text{threshold}}$$
   • If displacement exceeds maximum legal speed plus latency buffer, snap the player back to their last validated server position and flag anomalous telemetry.
3. Ray-Swept Collision Bounds:
   • Verify movement vectors using server-side ray sweeps to prevent clipping through solid geometry ("noclip" cheats).

Step 2: Combat & Action Validation

1. Fire Rate & Ammo Accounting:
   • Track weapon state strictly on the server: cooldown timer between shots, reload animations, magazine capacity.
   • Instantly drop firing requests if the time delta between shots is lower than the weapon's configured firing delay.
2. Lag Compensation & Rewind Bounds:
   • For hitscan weapons, the server maintains a circular buffer of past entity positions (typically 1,000ms).
   • When a client claims a hit at timestamp $T$, the server rewinds player hitboxes to timestamp $T$, performs a raycast, and validates line-of-sight.
   • Security Bound: Cap maximum backward rewind at 200ms. If client latency exceeds 200ms, hits are rejected to prevent players behind cover from being shot by lagging clients.