Say I have a game, when you finish playing you put your name in and your score is synched with a public scoreboard. Assume also that I own the server and its code. How can I verify that the scores received by public clients are legitimate and not fake?

Malicious use-case: I play the game, then I open burp and capture the packet to the server. I change the score to be 9999999 and forward the packet.

How can I prevent this?

1 Answer 1


Welcome to the ever evolving topic of anti-cheating measures. It's a cat and mouse game of ever evolving controls and circumventions. You're right, functionally anyone can sign anything. Having a client report their score is a recipe for disaster.

In many cases, the server is is the one that does the score calculation, it's much harder to hack a server than one's own game.

In competitive settings, notable scores often require a recording (see speedrunning).

If you wanted a cryptography solution, one might chain every action taken in the game to the previous action cryptographically. Random judges could then verify no illegal moves and sign the score. I guess that would be blockchain gaming, and you can have that idea for free.

  • 1
    Yeah, in these cases, the client sends updates of actions, not score summaries.
    – schroeder
    Oct 5, 2022 at 14:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .