Roblox Security Audit: RemoteEvent Exploits & Data Loss

Summary

Audited every Luau file mapped by default.project.json and every RemoteEvent/RemoteFunction. Report written to audit/luau-security-audit.md. Every finding below was re-read at its cited line before it went in. Excerpt (identifiers renamed, comments trimmed):

[1] Client chooses the coin amount in ClaimReward

• Severity: Critical · Effort: S · Confidence: High
• Location: src/server/Rewards.server.luau:5-9

ReplicatedStorage.Remotes.ClaimReward.OnServerEvent:Connect(function(player, rewardId, amount)
	local profile = Profiles.Get(player)
	profile.Coins += amount
	profile.Claimed[rewardId] = true
end)

Root cause: amount comes from the client and is added unchecked. rewardId is never checked against a server list or against Claimed.

Exploit path: an exploit script fires ClaimReward:FireServer("daily", 1e9) once for a billion coins, or fires it in a loop with any rewardId to claim the same reward forever.

• Proposed fix:

local REWARDS = { daily = 100, weekly = 750 }

ReplicatedStorage.Remotes.ClaimReward.OnServerEvent:Connect(function(player, rewardId)
	local value = REWARDS[rewardId]
	local profile = Profiles.Get(player)
	if not value or not profile or profile.Claimed[rewardId] then
		return
	end
	profile.Claimed[rewardId] = true
	profile.Coins += value
end)

Why this works: the server owns every number. The client only names which reward it wants, and the server decides whether that is allowed and what it is worth. This removes the whole class of "client sends the value" bugs, not just this one.

• Hardening: log any rewardId that isn't in REWARDS. Only an exploit sends one.

[2] Receipt retry returns PurchaseGranted after a failed save

• Severity: Critical · Effort: M · Confidence: High
• Location: src/server/Receipts.luau:126-128, 188-195

if profile.Receipts[receiptInfo.PurchaseId] then
	return Enum.ProductPurchaseDecision.PurchaseGranted
end
-- …
local saved = DataManager.Save(player)
if not saved then
	return Enum.ProductPurchaseDecision.NotProcessedYet
end

Root cause: the receipt is marked in memory before the save. When the save fails, the first call correctly returns NotProcessedYet. But Roblox retries, the retry finds the in-memory mark and returns PurchaseGranted without saving.

Failure path: player buys a product → DataStore hiccup → retry reports it granted → server shuts down before the autosave → Roblox never redelivers. The player paid Robux and the item is gone.

Proposed fix: track receipts that were applied but not yet saved. On retry, save again and return PurchaseGranted only once the save succeeds.

Why this works: PurchaseGranted tells Roblox to stop retrying. It must only be returned once the grant is durable.

Suggested fix order

1. Fix #1 and #4 first. Both take minutes and close the open economy exploits.
2. Fix #2 next, then test it in Studio by forcing DataManager.Save to return false once.
3. Fix #3 by marking the profile dirty on every deduction, then grep for other spends that never save.

Next steps

• Work through the full report in audit/luau-security-audit.md, top to bottom.
• Re-run the audit after the fixes to confirm the critical findings are gone.