Threat Model & Mitigations

# Exploit Defense Matrix

Below is a detailed breakdown of 12 common Roblox exploits and the corresponding RAC countermeasures:

Exploit Class	Attack Method	RAC Mitigation Strategy
1. Speed Hack	Multiplies client AssemblyLinearVelocity or offsets CFrame	SpeedDetector measures horizontal displacement $\Delta d / \Delta t$ against authoritative WalkSpeed; rolls back position.
2. Flight / Levitation	Anchors character in mid-air or counters gravity	FlyDetector tracks continuous airtime without ground contact via downward raycasts.
3. Teleportation	Overwrites HumanoidRootPart.CFrame to stage end	TeleportDetector flags position jumps $> 50\text{ studs/s}$ and resets CFrame to last valid snapshot.
4. Noclip	Disables part collision (CanCollide = false)	NoclipDetector performs geometric raycasting between old and new position to detect wall penetration.
5. Infinite Jump	Fires jump impulses while airborne	JumpDetector tracks upward velocity bursts and limits multi-jumps to 2 within a 2-second window.
6. Reach Hack	Extends melee weapon hitbox across the map	ReachValidator validates that Euclidean distance between attacker and target is $\le 18\text{ studs}$.
7. Wallbang	Fires weapons through walls and solid terrain	WeaponDamageValidator casts line-of-sight ray between shooter and victim.
8. Rapid Fire / Kill-All	Fires attack remotes thousands of times per second	FireRateValidator enforces a minimum cooldown interval ($0.08\text{s}$) between hits.
9. GodMode	Hooks Humanoid metatable to cancel damage	GodModeDetector confirms health decreases after verified damage; reverts unauthorized property locks.
10. Remote Packet Flooding	Floods remotes with spam to lag server	RemoteRateLimiter enforces a 35 req/s token-bucket cap per player, silently dropping excess calls.
11. Memory Crasher	Sends 100MB string or cyclic table payload	RemotePayloadValidator drops packets $> 16\text{ KB}$ and enforces max table recursion depth of 4.
12. Dex Explorer / Remote Spy	Scans for unexposed remotes to exploit	HoneypotManager catches invocations on decoy remotes, immediately issuing a permanent ban.

---

# Next Steps

• Explore Security Best Practices.
• Review the Diagnostics Guide.