If you are using Unity colliders and use collisions from them to control the simulation, chances are you don't have a deterministic simulation. You have a few options to deal with that:
- Make it deterministic. Generally this means a fixed timestep and doing all calculations with fixed-point math instead of floating-point. This probably means writing your own physics engine, so unless the simulation is really simple it's probably going to be a lot of work, but here are a few resources that might be helpful: Floating Point Determinism, Lockstep Implementation in Unity3D.
- Minimize non-determinism and hope for the best. I don't have much experience with this, but I'm sure lots of people have tried. You'll probably need to have generous leeway to avoid false positives when trying to detect cheaters, which means some might slip through, and the butterfly effect means you'll likely never be able to prevent all false-positives.
If you do manage to solve the determinism problem, you may still be left with a server performance problem. Luckily, the solution for that is simple. Just let the server randomly decide whether to validate a particular "round" of gameplay. If you don't validate it, you can just assume that the player is honest. Some additional layers of complexity you might want to consider:
- Increase the chance of validation for a particular player every time the server skips doing it (but it should still be mostly random to prevent hostile players being able to predict which ones will be validated).
- If a player fails a validation, place them on probation and validate every subsequent event for that player for a certain amount of time.
- If a player repeatedly fails validation, just permaban them.
- Vary the chance to do a validation based on server load. During off-peak hours, you can afford to spend more server time validating.
- Store data for unvalidated actions in a database, and provide a tool to do validation and remediation of previous results.
- Make a tool that allows a human to replay what the player did. This helps triage reported abuse even if your simulation isn't deterministic at all; data from cheaters is probably going to look really obvious.
- If you can't make the entire simulation deterministic, just validate the parts that are deterministic. For example, if a unit normally does 50 damage, but in the replay it does 10,000...
In the end it's up to you how much time, effort, and money you want to spend dealing with cheaters.
