Client-Server Trust Model

# The Zero-Trust Client Axiom

In Roblox, developers often mistakenly assume:

1. "The client cannot fire a RemoteEvent if the UI button is disabled."
2. "The client cannot move faster than Humanoid.WalkSpeed."
3. "The client cannot damage an enemy that is behind a concrete wall."

All three assumptions are false. An attacker with an active Luau executor can:

• Call any RemoteEvent:FireServer() or RemoteFunction:InvokeServer() with arbitrary arguments.
• Directly overwrite HumanoidRootPart.CFrame or AssemblyLinearVelocity in memory.
• Hook into weapon scripts and bypass raycast logic completely.

RAC treats the client environment as compromised from the start.

---

# What the Server Validates vs. What the Client Sends

Action	Client Input (Untrusted)	Server Enforcement (RAC)
Player Walking	Replicated position & velocity	Validates distance traveled $\le (v_{max} \cdot \Delta t)$. Reverts position on violation.
Firing Weapons	Target player ID & hit position	Server raycasts line of sight. Verifies target is within max weapon reach and weapon cooldown has elapsed.
Jumping	Replicated upward velocity	Checks ground raycast to ensure player was standing on a solid surface before granting upward impulse.
Remote Requests	Packets over Remotes	Token-bucket rate limiter restricts calls to $\le 30$ req/sec. Payloads $> 16\text{ KB}$ are discarded.
Character Health	Replicated Humanoid properties	Server owns MaxHealth and Health. Client tampering triggers immediate state reversion.

---

# Honeypot Deception

To proactively identify malicious users before they disrupt gameplay, RAC registers deceptive honeypot RemoteEvents in ReplicatedStorage.RAC.Remotes:

• ClaimFreeRobux
• Admin_SetLevel
• GiveAllItems

Legitimate game UI scripts never interact with these remotes. Only exploiters scanning the game tree with Dex Explorer or decompilers will attempt to fire them. Any invocation immediately results in a 1.0 confidence flag and instant permanent ban.

---

# Next Steps

• Explore the Configuration Reference to customize parameters for your game.
• Review Deceptive Honeypots for details on decoy traps.