Skip to content

Conversation

@PotatoFarmer441
Copy link

Resolves an exploit introduced by overextended#515 (see #55) that allows bad actors to replicate an excessive number of props and force players within sync range to crash. This is based on changes by @Maximus7474 but with some additional fixes/improvements.

  • Limits the number of props that can be spawned using convar ox:progressPropLimit.
  • Adds validation for requested models, ensuring playerProps are only stored when a valid entity is created.
  • Invalid models will no longer error and stop execution of the statebag handler.
  • Adds support for strict state bags.
  • Disallows spawning additional props for players who already have attached props.

If you aren't already, you should be aiming to support setr sv_stateBagStrictMode 1 in all your scripts to prevent unverified client-set values from being synced to all players.

@xodashy
Copy link

xodashy commented Nov 3, 2025

Can confirm this is indeed an issue.

Copy link
Member

@antond15 antond15 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants