RemoteEvent accepts impossible damage or currency values

Issue
An exploiter can request excessive damage, currency, or purchases by changing RemoteEvent arguments.

Cause
The server treats client-supplied results as facts.

Fix
Let the client send intent such as item ID or attack input. Resolve prices, ownership, cooldowns, positions, and damage from server-controlled state. Validate types and ranges before indexing tables. Rate-limit each action and reject impossible state transitions.

Verify
Fire the remote with wrong types, huge values, rapid repetition, distant targets, and items the account does not own.

Official Roblox server-authority security context