Networking in a strategy, city management game

Question

I'm developing a city management mobile game with its' share of multiplayer elements (leaderboards, achievements, social interactions). It's built using Unity and GameSparks as a backend. I'm a little bit confused on how I should be implementing the networking.

At the end of every in-game month, the game should go through every business building, calculate the revenue (each building generates different amounts of money depending on the number of workers), then add this value to the player's funds. These funds can then be used to continue building more businesses and houses, which increase the population.

I have to save the states for the city (buildings, population, etc) and player (funds, premium currency, etc) in the cloud.

I'm afraid people will exploit the game (due to the leaderboards) if I entrust data with the client, and I feel it would be best to keep the system deterministic, but I'm not completely sure I'm doing the right thing. How would you solve the problem?

Answer 1

Never trust the client (If you care about player experience and want to limit the possibility of cheaters, that is).

It seems you already have the right idea by storing the states of all relevant data on the cloud, and keeping it deterministic. Then at the end of each month your cloud server(s) can calculate each player's stats, based on the data already stored.

You want to be careful about how the clients affect the server state. You should maintain a set of rules on the server that validate incoming data.

For example, the server will probably track funds and land area, so if a player wants to place a building, the server should:

1. Verify the player has sufficient funding
2. Verify the placement of the building is valid
3. If valid, adjust the player's funds, building data, and land grid

It gets a little more tricky when dealing with offline play. You will probably want to simulate everything without requiring a response from the server, so players can play without Internet access. You will have to store a queue of actions to send to the server upon a connection, which will then verify the game state. The server can then replicate the game state back to the client--it is the authority.