While talking to a friend about how PvP was going in Ashes of Creation, he mentioned some bugs that they were experiencing with PvP mechanics, in particular players disconnecting while in combat and being immediately removed from the server. This gave me an idea to write this blog post outlining all of the various problems…

Lobsters is a community-driven platform for sharing and discussing links to articles, tutorials, and projects related to technology and programming. Readers can learn about a wide range of topics, from software development and system administration to cybersecurity and artificial intelligence. With user submissions, comments, and voting, Lobsters provides a platform for collaborative learning and knowledge sharing among technology enthusiasts.

Lobsters

PvP MMORPGs face numerous security challenges, including network-level attacks, client-level cheating, and economic exploits. Mitigation strategies include using encryption, validating packets, setting rate limits, obfuscating traffic, and performing rigorous security assessments. It's crucial to avoid trusting client inputs and to implement strong authentication methods. Duplication of items and currency due to poor transaction handling can critically impact game economies. Balancing combat mechanics and curbing exploits like aimbots, teleportation hacks, and random number generator (RNG) manipulation are also essential to maintaining game integrity.

You can’t get more adversarial than PvP MMORPGs

Imbalanced Conversion, Transfers, Stacking

The extra up-front effort of making the server the single source of truth far outweighs the cat-and-mouse game you’d be playing with hackers for years, or the loss of trust if your game is ever hacked in a public way (like flying or clipping through things).
Never, ever, trust the client.
Rate limiting is smart though.

Using the server as the SSOT is much better to eliminate part of the effort put in client-side protection. It indeed strains the server a little bit more but it even allows better observability. Lots of modern games now use this approach.

Pulling mobs on to someone is fun. Please don’t solve a funy bug