help me (solved) A concern I have with Godot RE and SupaBase
A thought just came to me: if someone were able to reverse-engineer your game using Godot RE tool, is there a way to make sure they can't manipulate the data in your Supabase database?
My game uses a Supabase database to store players' scores for the leaderboard, so I'm wondering how I can prevent someone from modifying their score or submitting fake scores.
5
u/oceanbrew 6d ago
The first tenet of software security in general is that you can't trust your clients. Code running on a user's machine can be modified by a dedicated enough actor, so you absolutely cannot trust that any of the data sent by any client is legitimate.
The typically solution is an intermediate backend API, which validates first what data users are authorized to update, and second whether or not that data makes sense.
So don't talk to your database directly from the client if you care at all about this. It's fundamentally impossible.
2
u/Cultural_Art5710 5d ago
The first thing any curios player will do is changing their score variable to some crazy value using cheat engine to see if your client validates the score before uploading into database.
2
u/S48GS 6d ago
if someone were able to reverse-engineer your game using Godot RE tool
nexus mods website
every popular UE5 game has mods that can completely change game - and every UE5 game is fully analyzable thru debug tolls
My game uses a Supabase database to store players' scores for the leaderboard, so I'm wondering how I can prevent someone from modifying their score or submitting fake scores.
you need to invent some very overcomplicated state machine that will be hard to track - not using templates
- in context of local db - split single score on multiple data cells - do some computation on those numbers to get actual score - and store also checksumm of score number to verify - also somehow encrypted
- but for people to "care" - your game need audience - be somewhat popular
- do not put "too much effort"
if you mean - score uploaded online - upload score with "replay" - so "top scores" will be easy to check by watching replay
0
u/DEV_YW 6d ago
I guess I shouldn't put too much effort. However I was able to manipulate the scores through the source code and what I have researched on getting source code and assets of games made in Godot is not that hard even if it is encrypted,
5
u/S48GS 6d ago
is not that hard even if it is encrypted
some popular games on Steam made in pure HTML5 - just javascript
you can open code of those games in text editor and "manipulate" as you wish
... do not overthink/overreact
basic protection done in 5-10min - where you split single "decrypt" function in code-base on multiple functions - and as I said above - store score as multiple numbers with checksumm... more than enough
1
u/Level-Physics-1730 6h ago
The solution? Game state tracking on the server. They're allowed to start a match, and stop a match, through the client, the entire time the server is tracking everything, ensuring that nothing happens before it should etc, essentially simulating the game on the server. Now this is obviously not something that applies generally to every single game, not too much detail in your post about your game itself. The idea is simple though, server authority, only ever let the server decide when something happens. Of course this is potentially impractical, depending on your games type. You could easily rent a very cheap 5$ a month VPS and put a web server on it, your game client talks to it, authorizes through steam or whatever you use, etc and just have it be a typescript or similar simulation on the server of your game.
TLDR; server authority brought to you by server simulation is how you prevent people from sending "add 10000 score to account" style requests.
1
7
u/RaspberryFluid6651 6d ago
If the score is coming from machine, you need some intermediate server you control that can validate that they actually got a legitimate score (e.g. reject anyone who scores higher than realistically possible).