I want to make a game where you can trade items you find from the world, the world would be static, so the master server would always know exactly how much items of X there are etc.

What should i take into account when building such a system?

I want to avoid people being able to cheat and filling the game with free items, but at the same time i want it to be as less server dependant as possible, as i cant afford buying thousands of servers just to run their games on them constantly, even if i had the money, i would prefer not make people to rely on my servers so they can be playing it at any time they want at anywhere, but if they want to ensure the validity of the objects he is going to buy from someone, he would have to connect to the master server if he wants to ensure the objects validity.

But how could i know which objects are genuine and which are fake? So i thought i would give each object in the world an unique ID which cannot be guessed. But then again, wouldnt i have to somehow prove that i collected those items with valid actions? And how could i possibly do that without making the server to run my game from the beginning? And how could i prevent someone trading the same item twice etc.

So i thought i could use a Bitcoin system, but i dont know much about it and im not sure would this be an option since there would be a lot of trading, and a lot more "coins" to trade, so the amount of history information might be too much to handle, not to mention i want to prevent people from cheating in any way, for example you cant trade stuff from the other side of the world and magically teleport the items there (assuming you dont own a teleport atm), you would have to move the items across the world, which would take some time. Also im not very excited about the fact that Bitcoins generation will use intense amounts of CPU power, and im not sure would there be enough Bitcoins for everyone to use; everyone should have equal chance of getting items without depending how fast CPU they have, and im not sure how it would work with fractions of items (like 0.1 of money etc).

Any thoughts and ideas appreciated.

  • \$\begingroup\$ Do I understand correctly that each player essentially has a separate copy of the game world which runs locally on their system, but you want to allow players to trade items between worlds? \$\endgroup\$ – Ilmari Karonen Sep 28 '11 at 17:57
  • \$\begingroup\$ yes, although i wouldnt allow players having the whole world, only those areas they have explored. also, two players cant have the same location in the world, so they cant overlap. once you are done playing and you go offline, you upload your stuff to server so others can see where you are spread at the moment to prevent overlapping and to allow players seeing each other worlds. \$\endgroup\$ – Gerry Sep 28 '11 at 23:09
  • \$\begingroup\$ @ilmari, oh and the players could see the whole world, but wont see where all the items are until they explore. \$\endgroup\$ – Gerry Sep 28 '11 at 23:19

The basic idea is trust. Who can you trust? Nobody. So, don't. Don't let the users decide anything, everything that requires trust happens on the server.

Items only "exist" on the server. Money only "exists" on the server. The clients can do requests (like "I'd like to sell item X"), the server sees who owns what, and thus you can't sell something you don't own. Or buy stuff with money that the server knows you have.

Only delegate things to clients that don't really matter, like particle systems, motion prediction, that sort of stuff.

(Of course you may end up having to trust the client in some things for performance / gameplay reasons, but know that it's always a risk).

  • \$\begingroup\$ it could be as simple as that; items just are on the server and just check if player X has item Y etc. but, the real problem is how to make it sure player X doesnt steal all the items from the world by simply telling the server "i have item X now" million times for all of the items there. so the server would need to know the player got the item legitimately. this is where i need some ideas! \$\endgroup\$ – Gerry Sep 28 '11 at 23:13
  • 3
    \$\begingroup\$ Why would you trust the client to say he has some item? the server can is the only authority that can tell whether the player has the item or not. Don't trust the client! \$\endgroup\$ – Jari Komppa Sep 29 '11 at 4:40
  • 2
    \$\begingroup\$ So let's say client says "pick up object X", the server has to check whether that's possible or not, and make decision based on the facts that it has. \$\endgroup\$ – Jari Komppa Sep 29 '11 at 4:41
  • 4
    \$\begingroup\$ Then you basically can't do it in a secure manner. When you give the control to the user, you're basically saying "here's a box of goodies, but it's locked; only open it with this key which I also happen to provide to you". \$\endgroup\$ – Jari Komppa Sep 29 '11 at 11:09
  • 2
    \$\begingroup\$ There are ways to make it harder, but it's always a losing battle. See DRM. \$\endgroup\$ – Jari Komppa Sep 29 '11 at 11:10

Client A invites Client B to trade through the server (so if A is annoying, B can blacklist him).

If A and B decide to trade item N and M, they both sent an 'OK for N and M) to the server.

Server makes the change and sends messages to A and B.

No P2P, No bitcoins, No 'trust the client just a bit'.

Simple, fast secure and easy (you can even log the transactions!). What do the world need more than that?

Oh yes, "...I cant afford buying thousands of servers...".

I have a server up and running, the game isn't 100% about trading but you can do it and the bandwith it uses is about nothing. I pay somewhere about 25 dollars or 18 euros a month for the server + a 100Mbit connection. There can be quite a lot of players trading things there before I need an upgrade.

In this case I'd say: Do the game, rent a server (don't buy it) and think about scalability later.

  • \$\begingroup\$ Even better, use Google App Engine for the trade server so you have a cheap way to handle transactions. \$\endgroup\$ – Chiguireitor Sep 28 '11 at 20:53
  • \$\begingroup\$ as i noted in other comments: the real problem is how the player gets the items; how do i ensure the player got his stuff from the world legitimately? - Chiguireitor, good idea by using others free(?) servers, didnt think of that! \$\endgroup\$ – Gerry Sep 28 '11 at 23:16
  • 1
    \$\begingroup\$ Gerry: You can ensure the player got the items legitimately because the server knows where the players are and where the items are, allowing it to say "no" if a player attempts to illegitimately pick an item up. \$\endgroup\$ – Dave Sherohman Sep 29 '11 at 9:44
  • \$\begingroup\$ its not as simple as "pick up item if player x is in radius of y", i simplified the question a lot to get some general ideas about the topic. the rules behind "picking up items" are way more complicated and thats why i thought "i need thousands of servers" \$\endgroup\$ – Gerry Sep 29 '11 at 10:57
  • 2
    \$\begingroup\$ Normally the server handles ALL important things, like items. The server will tell player A and B what kind of item they have, the players (clients) themselves will Never send messages like 'I have item 23', 'I have 1000 HP and a does 10000 damage to you', neither to the server nor to another client. Clients Ask (the server), the Server tells what happened (you tried to change an item you don"t have, You attack with attack Nr 5 you did 15 damage, ...) \$\endgroup\$ – Valmond Sep 29 '11 at 11:55

As others have said, you can't have a totally secure system without an authoritative server. The best you could do would be some sort of voting system, where clients ask each other if a move is reasonable, and go with a majority vote. That's basically how the bitcoin system you were talking about works, the theory being that a few cheats are going to get overruled by a mass of legit users.

If you want the player to be able to play offline then upload a game state (that sounds like what you're talking about) then it all gets a whole lot harder. The best you can do is close your source, encrypt everything, and hope no-one with decent programming skills cares enough to cheat - which is probably a reasonably safe bet.

As with a lot of these sort of problems for indie games (piracy is another example), if you have to care then you're probably successful already.

  • \$\begingroup\$ yeah but asking everyone if your move is legit or not, may be too much to handle... i mean if i move some guy, i would have to prove it to the main server my move was legit (without making the main server compute it), and how would i do that: i send my whole world to 10 other players, and if majority says its legit then the server would believe me. but theres this little problem i dont want nor i can check for every movement like that.. so the game would then be limited to, lets say 10 users who would basically compute each others movements at all times. eh. how does World Of Warcraft do this? \$\endgroup\$ – Gerry Sep 29 '11 at 17:45
  • \$\begingroup\$ im not sure how the encryption would work either... what exactly am i encrypting? would i generate some sort of hash from all the movements, and this hash could be proven valid somehow. but i have no idea how these things work... if you know more about this i would be glad to hear. \$\endgroup\$ – Gerry Sep 29 '11 at 17:47
  • \$\begingroup\$ Gerry: WoW does it by having all meaningful events processed solely on the server, which then tells the client the result. The clients do draw results of things like movement in advance, but will snap you back to the "real" position if the server disagrees with the outcome (commonly known as "rubber-banding"). You may have also noticed that, when an MMO lags, you may have to click on an object repeatedly to pick it up, or just click once and then wait several seconds before it pops into your inventory; this is because the client is waiting for the server to OK the action. \$\endgroup\$ – Dave Sherohman Sep 30 '11 at 10:30
  • 1
    \$\begingroup\$ Pretty much the only things that an MMO client will do on its own without the server's intervention are inconsequential, purely cosmetic details, such as particle effects, which don't need to be consistent from one user to the next. \$\endgroup\$ – Dave Sherohman Sep 30 '11 at 10:31
  • \$\begingroup\$ @dave, maybe that is the only way... i could make it cost money to play monthly like WoW does, just to pay the servers costs, and allow people still play outside of the main servers without any trust. \$\endgroup\$ – Gerry Sep 30 '11 at 12:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.