Network & Remote Detection Modules

# Overview

Exploits frequently attempt to crash or lag Roblox game servers by flooding RemoteEvent instances with thousands of requests per second (Remote Spam) or sending deeply nested tables and gigantic strings (Memory Exhaustion / Crashers).

RAC secures all game remotes using two server-side network layers:

1. RemoteRateLimiter: Token-bucket algorithm enforcing a 35 req/s rate limit per player.
2. RemotePayloadValidator: 16KB packet size enforcement and argument type checking.

---

# 1. RemoteRateLimiter (RemoteRateLimiter.luau)

# Token-Bucket Algorithm

Each connected player is allocated a token bucket:

• Bucket Capacity: $40$ tokens.
• Refill Rate: $35$ tokens per second.
• Cost per Call: $1$ token.

       Incoming Remote Call
                 │
                 ▼
       ┌──────────────────┐
       │ Tokens > 0?      │
       └─────────┬────────┘
        YES      │      NO
   ┌─────────────┴─────────────┐
   ▼                           ▼
[Consume 1 Token]       [Reject & Throttle Call]
[Execute Handler]       [Increment Spam Counter]

If a player exhausts their bucket, subsequent calls are dropped silently on the server, preventing server-frame lag. Continued spamming triggers a high-severity incident report.

---

# 2. RemotePayloadValidator (RemotePayloadValidator.luau)

Inspects inbound remote arguments before passing them to game handlers.

# Key Checks

# 1. Payload Size Cap (16 KB)

Calculates the estimated serialized size of strings, tables, and buffer arguments. Any packet exceeding 16,384 bytes (16 KB) is immediately rejected:

if estimatedPayloadBytes > Config.Detectors.Remote.MaxPayloadSizeBytes then
    -- Drop payload to protect server RAM
    warn(string.format("[RAC:Network] Dropped oversized payload (%d bytes) from %s", estimatedPayloadBytes, player.Name))
    return false
end

# 2. Deep Table Recursion Guard

Exploiters can pass self-referential or 100-level deep nested tables that crash standard JSON encoders. The validator enforces a maximum recursion depth of $4$ levels.

# 3. NaN and Inf Number Checks

Checks all numeric parameters for NaN (Not-a-Number) and math.huge values that cause physics NaN propagation and database write errors.

---

# Wrapping Your Game Remotes

To protect your own custom remotes with RAC's rate limiter and payload inspector:

-- Server script
local RAC = require(game.ServerScriptService.RAC.Engine)
local BuyItemRemote = game.ReplicatedStorage.Remotes.BuyItem

BuyItemRemote.OnServerEvent:Connect(function(player, itemName, quantity)
    -- Validate packet with RAC
    local isAllowed = RAC:AuditRemoteCall(player, "BuyItem", itemName, quantity)
    if not isAllowed then
        return
    end

    -- Process game logic safely
    ProcessPurchase(player, itemName, quantity)
end)

---

# Next Steps

• Explore Economy & Inventory Detectors.
• Learn about Deceptive Honeypots to catch remote scanners.