I'm in the process of making a racing game for Android/iOS. I'm thinking of implementing a server/client model, should I worry about cheating and make all players communicate with a server of mine, or will I be good by letting one of the players host the game?
Unfortuntely it's very difficult to prevent cheating when something is only done on the client side or a server hosted by a client. There are lot's of tools for memory editing&locking, package sniffing/editing and similar activities.
There are some ways to make it a bit more difficult, but as soon as one person decompiles your app and takes a look at your prevention methods, it'll be almost useless as well.
I've got a similar problem to solve in the near future and I'm about to try something based on serialized values (which I won't manipulate or even address in code) as I once heard they cannot be tracked easily in the final builds (who knows if that's true though...). This needs some further research but this information may be useful for you. If that is true, you could maybe use them as a calculation factor for check-values.
However, the best and most secure way is to have your own servers and handle critical/sensitive logic there.
In android its very easy to manipulate scores. You just need a rooted phone and one app. It can freeze the other app or manipulate in real time. If you let somebody edit his score to 1324891234042390 and send this to the server this won't be very useful for you. I don't know how to prevent it, but i know its easy to perform as the cheater