1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
|
================================================================================
SCREECHVR: FINAL SECURITY RESEARCH CORRECTION, VALIDATION & COMPLETE TEXT BUNDLE
================================================================================
Cover and scope
================================================================================
Project name: ScreechVR (Voideration Anti-Cheat)
Research date: 2026-10-28 (correction pass 2026-10-29)
Purpose: Final correction pass consolidating all verified findings, corrections,
supporting evidence, architecture decisions, unresolved issues, and research
activity into one self-contained text file for independent review.
No implementation was performed. No project files were modified. No services were
deployed. No production data was changed. No credentials were reproduced.
Research-only phase. Awaiting explicit approval before any code is written.
================================================================================
Executive findings
================================================================================
Most important verified findings:
1. ScreechVR uses Unity 2021.3 LTS, Photon PUN 2 + Voice, PlayFab, Meta/Oculus SDK,
Cloudflare Worker. IL2CPP for Quest builds.
2. Currency is client-trusted: Oculus_Login.cs AddCurrency/RemoveCurrency update local
_currency before server call; BuyCosmetic checks local balance. PlayFab
AddUserVirtualCurrency accepts client-specified amount (validates session, not amount).
3. Moderator status stored in PlayFab UserData "Moderator" key (likely client-writable).
Check_Mod.cs sets AccountPref after 5s timeout. CRITICAL if writable.
4. Bans enforced client-side only: KickIfBanned polls GetAccountInfo every 5s;
Kick_Player triggers Application.Quit. Modified client can ignore both.
5. No movement validation: Player.cs locomotion all client-side. No server validation.
6. Master client is a player, not a server. AutomaticallySyncScene=true allows master
to force scene loads on all clients.
7. No anti-cheat scripts exist. No server-side validation of movement, position, or score.
8. Photon RPCs lack ownership checks, param validation, rate limits (ThusterController
floods, Flash_Light held-button floods).
9. Null crashes throughout (PlayerSpawner, Hand_Physic, Monster_Track, etc.) unguarded.
10. AppEntitlementCheck logs only, does not quit on failure.
Highest-severity unresolved issues:
1. PlayFab UserData "Moderator" key writability (CRITICAL if client-writable).
2. CloudScript/Azure Functions deployment status (unknown, affects currency flow).
3. Meta attestation API availability (docs gated, UNVERIFIED).
4. Photon custom auth configuration (dashboard not inspected).
5. PlayFab PurchaseItem price validation (assumed, unverified).
Recommended next step: Verify the 5 critical items above (requires dashboard access),
then begin Stage 1 implementation (backend foundation) after user approval.
================================================================================
Project and research coverage
================================================================================
Source files inspected:
- Assets/Scripts/Oculus_Login.cs (auth, currency, ban, MOTD, title data, inventory)
- Assets/Scripts/ScreechApi.cs (worker HTTP client)
- Assets/Scripts/PhotonVRManager.cs (networking, rooms, cosmetics, gun)
- Assets/Scripts/PlayerSpawner.cs (spawn/despawn)
- Assets/Scripts/UsernameValidator.cs (content creator check)
- Assets/Scripts/AppEntitlementCheck.cs (Oculus entitlement, log only)
- Assets/Scripts/KickIfBanned.cs, Kick_Player.cs (ban/kick)
- Assets/Scripts/LevelSelect.cs, MapLoader.cs, sceneyessss.cs (scene loading)
- Assets/Scripts/Gamemode_System.cs, GamemodeManager.cs, Gamemode_.cs, DeployGamemode.cs
- Assets/Scripts/GetCosmetics.cs, SecondaryCosmetics.cs, BuyCosmetic.cs, Cosmetic_Yes.cs
- Assets/Scripts/TagManager.cs, TagPlayer.cs, TagLeaderboard.cs
- Assets/Scripts/BestJumpscare.cs (collider kill)
- Assets/Scripts/NewGorillaLocomotionScripts/Player.cs (locomotion)
- Assets/Scripts/Hand_Physic.cs (grab/physics)
- Packages/manifest.json (SDKs)
- Assets/Resources/GorillaPrefabs/Gorilla Rig.prefab
Research documents reviewed:
- research/ (27 reports + README + FINAL_RESEARCH_SUMMARY)
- research/FINAL_SECURITY_ARCHITECTURE/ (26 deliverables)
- docs/screechvr-technical-map-2026-10-28.md
- docs/voideration-screechvr-architecture.md
- docs/voideration-anticheat-research.md
- docs/voideration-anticheat-review.md
- docs/QUEST_MODIFICATION_THREAT_CATALOG.md (in research/)
- SHARED-MEMORY.md, AGENTS.md
Claims checked against official documentation:
- PlayFab: AddUserVirtualCurrency, PurchaseItem, LoginWithCustomID, GetPhotonAuthenticationToken, BanUsers, GetTitleData, GetUserData/UpdateUserData
- Photon: custom authentication response codes (0=incomplete, 1=success, 2=failure, 3=invalid params), PUN 2 maintenance mode
- Cloudflare: Workers free tier (100k req/day), D1 free tier (5GB, 5M reads/day, 100k writes/day), KV free tier
- Meta: attestation API (docs gated, 404 on all tried URLs)
- OWASP: API Security Top 10 2023, Cryptographic Storage Cheat Sheet
Items that could not be accessed:
- Meta developer portal (attestation docs, User Verification docs)
- PlayFab dashboard (CloudScript, UserData permissions, PurchaseItem config, ban enforcement)
- Photon dashboard (custom auth config, anonymous client setting, dev/prod app IDs)
- No hands-on testing performed (all tests are planned, not executed)
================================================================================
Photon authentication correction
================================================================================
Token distinctions (CRITICAL - not interchangeable):
- PlayFab Session Ticket: issued by PlayFab on login, used for PlayFab API calls and worker /redeem. Lifetime: session duration (hours). Verified by PlayFab.
- Photon Custom Auth Token: issued by PlayFab GetPhotonAuthenticationToken, used for Photon connection. Lifetime: short (minutes). Verified by Photon's servers (server-to-server call to your backend).
- Meta Oculus ID: hardware-bound identifier from Oculus Platform SDK. Used as PlayFab CustomId.
- Meta User Proof: one-time proof of account control (getUserProof). Verified server-side with Meta. NOT currently used in ScreechVR.
- Meta Attestation Token: device/app integrity token. UNVERIFIED availability.
Correct authentication flow:
1. Client: Oculus Core.Initialize + Users.GetLoggedInUser -> Oculus ID + username.
2. Client: PlayFab LoginWithCustomID (Oculus ID, CreateAccount=true) -> PlayFab session ticket.
3. Client: PlayFab GetPhotonAuthenticationToken (photonAppId) -> Photon token.
4. Client: Photon ConnectUsingSettings with custom auth params (Photon token).
5. Photon server: calls worker /validate-session with Photon token (server-to-server).
6. Worker: validates PlayFab session ticket, checks ban status, returns allow/deny + UserId.
7. Photon enforces result. Client cannot bypass.
Photon custom auth response codes (verified from official docs):
- ResultCode 0: incomplete (multi-step auth).
- ResultCode 1: success (allow).
- ResultCode 2: failure (deny).
- ResultCode 3: invalid parameters.
- Photon enforces: deny on failure, allow on success.
Configuration uncertainties (dashboard not inspected):
- Is custom auth configured in Photon dashboard?
- Is "Allow anonymous clients" disabled?
- Is the auth URL pointing to the worker?
- Are dev and prod app IDs separate?
Failure/replay behavior:
- Missing credentials: Photon denies connection (if custom auth configured).
- Invalid token: Photon denies connection.
- Expired session: PlayFab session ticket expired -> worker returns deny.
- Revoked session: worker must track session IDs and reject revoked ones (not currently implemented).
- Banned account: worker checks ban status (PlayFab GetAccountInfo) -> deny.
- Anonymous client: if "Allow anonymous clients" enabled, client can connect without auth (VULNERABILITY).
- Backend timeout: Photon's behavior on timeout is UNVERIFIED. May allow or deny.
- Backend outage: if worker is down, Photon custom auth fails -> Photon may deny or allow (depends on config).
Tests required:
- Invalid Photon credentials -> connection denied.
- Banned user -> connection denied.
- Anonymous client -> connection denied (if anonymous disabled).
- Expired session -> connection denied.
- Backend timeout -> connection denied (verify Photon behavior).
- Old client -> connection denied (version check).
================================================================================
Meta identity verification correction
================================================================================
Current flow (verified):
Oculus ID -> PlayFab LoginWithCustomID (no proof verification) -> PlayFab session ticket.
VULNERABILITY: Client provides Oculus ID without proof. Modified client can claim any Oculus ID.
Proposed fix (not implemented):
1. Client: Oculus Core.Initialize + Users.GetLoggedInUser -> Oculus ID + username.
2. Client: Request Meta User Proof (getUserProof) with server-generated nonce.
3. Client: Send proof + Oculus ID to backend (worker).
4. Backend: Verify proof with Meta's servers (server-to-server).
5. Backend: If verified, link/create PlayFab account (LoginWithCustomID with verified Oculus ID).
6. Backend: Issue session token (JWT) bound to verified identity.
Compatibility (UNVERIFIED):
- Unity 2021.3.32f1: Meta SDK version compatibility unknown.
- Required permissions: Data Use Checkup (User ID, User Profile, Device Ban).
- Account migration: existing players need migration path.
- Duplicate account handling: same Meta ID, multiple PlayFab accounts.
Security boundaries:
- Meta identity verification proves user controls the Meta account.
- Does NOT prove game integrity, no cheating, legitimate gameplay.
- Identity is one layer. Must combine with server-side validation and detection.
Tests required:
- Invalid Meta proof -> login denied.
- Replay of Meta proof -> login denied (nonce must be one-time).
- Account linking without proof -> login denied.
- Stale proof (expired nonce) -> login denied.
================================================================================
Meta attestation correction
================================================================================
Current documented API behavior (from Tomahawk research):
- Native symbol `ovr_DeviceApplicationIntegrity_GetIntegrityToken` present in libTomahawkCore.so.
- Tomahawk requires Meta Data Use Permissions: User ID, User Profile, Device Ban.
- ERR-5xxx codes suggest attestation reports: modified binary, invalid signature, rooted, ADB, cheat software, attestation failures.
Server-side verification:
- Tomahawk sends attestation token to its backend for verification.
- Backend verifies with Meta's servers (server-to-server).
- Result: actionCode 0 (pass), 1 (kick), 2 (ban) + errorCode.
Nonce, timestamp, expiration, replay:
- Token is one-time use (nonce-bound).
- Token has expiration (short-lived, minutes).
- Replay prevention: nonce must be unique and not reused.
- UNVERIFIED: exact token lifetime, nonce generation, replay window.
What remains unverified for ScreechVR:
- API availability to all Quest developers vs gated.
- Token verification endpoint and flow.
- Eligibility requirements.
- Platform restrictions (Quest 2/3/Pro differences).
- Whether available for sideloaded builds.
- Exact meaning of device_integrity_state (Advanced/Basic/NotTrusted).
- security_update_pending_days availability/meaning.
- Whether ScreechVR's Meta app has the required permissions.
Handling policy (proposed):
- Trusted: normal access.
- Suspicious: flag + increased monitoring.
- Untrusted: restrict sensitive actions (no purchases, no leaderboard submissions).
- Unsupported: allow with warning (log for analysis).
- Unavailable: allow with flag (service failure, not user's fault).
- Inconclusive: flag + manual review. Do not auto-ban.
================================================================================
PlayFab and privilege correction
================================================================================
Currency API findings (verified):
- Oculus_Login.cs: AddCurrency(int amount) calls PlayFab AddUserVirtualCurrency with client-specified amount.
- PlayFab validates session ticket but NOT amount. Client can grant arbitrary currency.
- BuyCosmetic.cs checks local _currency >= Price before calling PlayFab PurchaseItem.
- PlayFab PurchaseItem validates price server-side against catalog.
- Currency_Code = "HC". _currency is client-held int.
Moderator permissions (UNVERIFIED):
- Oculus_Login.cs: CreateKeyIfNot creates "Moderator"="FALSE" in PlayFab UserData.
- If UserData is client-writable (PlayFab default), any client can set "Moderator"="TRUE".
- Check_Mod.cs sets AccountPref = Moderator if UserData "Moderator" == "TRUE".
- Mod_Toggle.cs opens ModMenu if DefaultQueue == "MODDED".
- CRITICAL: Verify PlayFab UserData write permissions in dashboard. If client-writable, immediate critical vulnerability.
Purchase and inventory checks:
- PlayFab PurchaseItem validates price server-side against catalog (assumed, verify).
- Client gates on local balance (cosmetic issue, not security).
- Inventory: GetUserInventory (server-side). Cosmetic ownership should be verified server-side.
Ban enforcement:
- PlayFab bans are server-side (admin API). Ban status checked via GetAccountInfo.
- KickIfBanned polls every 5s (client-side, ignorable).
- No server-side kick enforcement (requires Photon custom auth ban check).
Other unresolved PlayFab flows:
- CloudScript/Azure Functions: none found in repo. Verify in dashboard.
- SpokesSigmaIAP receipt validation: not fully read.
- GDH leaderboard submission path: unknown anti-cheat.
- ATM_TAB/Atm_Manager: not deeply read.
- Leaderboard validation: unknown.
================================================================================
Backend and database cost correction
================================================================================
Current pricing sources (as of 2026-10):
- Cloudflare Workers: free 100k req/day, paid $5/mo + $0.50/million requests.
- Cloudflare D1: free 5GB, 5M reads/day, 100k writes/day. Paid: $0.001/100k reads, $1.00/1M writes.
- Cloudflare KV: free 100k reads/day, 1k writes/day. Paid: $0.50/million reads.
- Cloudflare R2: free 10GB storage, 1M reads/mo, 1M writes/mo. Paid: $0.015/GB/mo.
- Cloudflare Pages: free (unlimited static sites).
- PlayFab: free tier (limits vary, verify in dashboard).
- Photon: free tier 20 CCU. Paid: $95/mo for 100 CCU (verify current pricing).
- Sentry: free tier (5k errors/mo).
Workload assumptions:
- Heartbeat every 10s: 6 req/min per player = 360 req/hour per player.
- At 100 CCU: 36,000 req/hour = 864,000 req/day (exceeds free tier).
- At 1000 CCU: 360,000 req/hour = 8,640,000 req/day (exceeds free tier by 86x).
- D1 writes: 1 write per heartbeat = 864,000 writes/day at 100 CCU (exceeds free tier 100k/day).
Alternative heartbeat designs:
- Reduce heartbeat to 30s: 2 req/min per player = 120 req/hour = 2,880 req/day at 100 CCU (within free tier).
- Batch telemetry: send every 30s instead of per-event.
- Periodic persistence: write to D1 every 5 min, not every heartbeat.
- Use KV for session state (eventual consistency acceptable for liveness).
Costs at requested CCU scenarios:
- 50 CCU: $1-2/mo (domain only, all free tiers).
- 100 CCU: $5-16/mo (Cloudflare paid plan $5 + usage). Photon free tier (20 CCU) EXCEEDED -> upgrade to $95/mo.
- 500 CCU: $16-33/mo (Cloudflare) + $95/mo (Photon 100 CCU) = $111-128/mo.
- 1000 CCU: $16-40/mo (Cloudflare) + $200-500/mo (Photon, verify pricing) = $216-540/mo.
- 5000 CCU: $65-130/mo (Cloudflare) + $1000+/mo (Photon) = $1065+/mo.
Key insight: Photon is the cost bottleneck. Cloudflare scales cheaply. PlayFab scales with usage.
Free-tier limits and what happens when exceeded:
- Cloudflare: 429 Too Many Requests. Backend auth fails closed (deny connections).
- PlayFab: API calls fail. Client gets error. Game may not function.
- Photon: connection refused. Game unplayable (no multiplayer).
================================================================================
Multi-layer architecture review
================================================================================
13 layers (independent where possible):
1. Meta User Verification (platform) - identity proof. If bypassed: attacker claims any Oculus ID.
2. Meta Entitlement (platform) - app ownership. If bypassed: unentitled clients stay.
3. Meta Attestation (platform, optional) - device/app integrity. If bypassed: no device integrity signal.
4. PlayFab Auth (backend) - account identity. If bypassed: attacker creates accounts with arbitrary IDs.
5. Photon Custom Auth (network) - room admission. If bypassed: banned/invalid players connect.
6. Worker session validation (worker) - session validity. If bypassed: stale/revoked sessions work.
7. Backend authorization (worker) - API permissions. If bypassed: attacker calls any API.
8. Server-side economy (PlayFab/worker) - currency/inventory. If bypassed: attacker mints currency.
9. Server-side bans (PlayFab) - enforcement. If bypassed: banned player returns.
10. Detection engine (worker) - behavioral flags. If bypassed: suspicious behavior not flagged.
11. Rate limiting (worker/Cloudflare) - abuse prevention. If bypassed: attacker floods endpoints.
12. Audit logging (worker) - accountability. If bypassed: no evidence trail.
13. Dashboard security (worker) - admin protection. If bypassed: unauthorized admin access.
Common-mode failures:
- If Meta platform compromised: layers 1-3 fail. Layers 4-13 still function.
- If PlayFab compromised: layers 4, 8, 9 fail. Layers 1-3, 5-7, 10-13 still function.
- If worker compromised: layers 6, 7, 10, 11, 12, 13 fail. Layers 1-5, 8, 9 still function.
- If Photon compromised: layer 5 fails. Layers 1-4, 6-13 still function.
Attack-to-defense matrix: see research/ANTI_CHEAT_PREVENTION_DETECTION_MATRIX.md.
================================================================================
Photon RPC and gameplay authority findings
================================================================================
Actual enforcement points:
- Photon Cloud: relays RPCs, no param validation, no rate limiting, no game logic.
- Photon Master Client: player with flag, controls room properties and scene sync. Untrusted.
- Worker: can enforce rate limits on Worker API calls only (not Photon RPCs).
- PlayFab: can enforce bans, inventory, currency (server-side).
- Dedicated server: not available (v2+).
Client-controlled state (cannot be prevented without dedicated server):
- Movement/position (Player.cs, locomotion).
- Tag/infection state (TagPlayer.cs, TagManager.cs RPCs).
- Score/leaderboard submissions (GDH leaderboard).
- Cosmetic equip (GetCosmetics.cs, Photon props).
- Game state (Gamemode_System.cs, CurrentMode).
What can be prevented (server-side):
- Currency minting (move grants to worker/CloudScript).
- Moderator spoof (server-side role verification).
- Ban bypass (Photon custom auth ban check).
- Cosmetic spoof (backend inventory check).
- Version mismatch (title data + custom auth).
What can only be detected (heuristic, not prevention):
- Movement exploits (speed, teleport, fly).
- RPC floods (rate limit + flag).
- Tag/Infection spoof (flag non-tagger RPCs).
- Leaderboard faking (flag anomalies).
- Master client abuse (log + flag).
Recommended short-term (v1): Backend validation + heuristic detection + manual review.
Recommended long-term (v2+): Dedicated authoritative server for movement, scoring, bans.
================================================================================
Provider and authentication comparison corrections
================================================================================
Revised findings:
- Meta User Verification: strongest identity proof (hardware-bound). UNVERIFIED availability.
- PlayFab: good for auth/inventory/bans. Custom ID login is client-provided (not proof). Add Meta User Verification.
- Firebase Auth: good Unity support, free tier, but adds complexity. No clear benefit over PlayFab for Quest game.
- Supabase Auth: free tier pauses after 7 days inactivity. Not suitable for production without paid plan.
- Nakama: best open-source option. Authoritative multiplayer. High migration cost (20-30 weeks). Hosting $5-50/mo.
- Appwrite/PocketBase: limited Unity support. Not recommended.
- Keycloak/Ory/Authentik: heavy, overkill for solo dev. Self-hosted ops burden.
- Auth0/Clerk: good free tiers (7.5k-10k MAU). MAU limits. Not Quest-specific.
- AWS Cognito: 50k MAU free. Complex, AWS lock-in.
- Cloudflare: good for API/backend. No native game-user identity. Use with PlayFab.
Recommended: Meta User Verification + PlayFab (identity) + Cloudflare worker (API/backend) + Photon (networking). No new provider needed for v1.
Corrected free-tier limitations:
- Cloudflare Workers: 100k req/day (free). Exceeded -> 429 or $5/mo paid.
- Cloudflare D1: 5GB, 5M reads/day, 100k writes/day (free). Exceeded -> paid.
- PlayFab: free tier limits (verify in dashboard).
- Photon: free tier 20 CCU. Exceeded -> $95/mo for 100 CCU.
- Firebase: Spark plan (free, no credit card). Blaze (pay-as-you-go) for functions.
- Supabase: free tier pauses after 7 days inactivity.
================================================================================
Corrected final architecture
================================================================================
Text-based architecture diagram:
[Quest Client (Unity/IL2CPP)]
| Oculus Auth (Core.Initialize + Users.GetLoggedInUser)
| Meta User Proof (getUserProof, server-generated nonce)
| PlayFab Login (LoginWithCustomID, verified Oculus ID)
| PlayFab Session Ticket
| Photon Connect (Custom Auth -> Cloudflare worker)
| Heartbeat (every 30s -> worker)
| Telemetry (movement samples, events -> worker)
v
[Cloudflare Worker (trusted)]
| /validate-session (Meta proof + PlayFab ticket + ban check)
| /heartbeat (session liveness, duplicate detection)
| /report-flag (telemetry -> detection rules)
| /ban-check (real-time ban status)
| /redeem (existing, PlayFab ticket required)
| /motd (existing, public)
| /updateplayers (existing, public, rate-limited)
v
[D1 Database (SQLite)]
sessions, players, flags, bans, audit_log, ccu_snapshots, webhooks, detection_rules, evidence
v
[PlayFab (trusted backend)]
Auth, inventory, currency, bans, title data, leaderboards, user data
v
[Photon Cloud (semi-trusted relay)]
Rooms, RPCs, sync, voice. Master client = player.
Custom auth -> worker (server-to-server)
v
[Cloudflare Pages (dashboard)]
React + Tailwind + shadcn/ui. Auth: email+password+TOTP. JWT. RBAC.
Reads from worker API only.
Sources of truth:
- Player identity: PlayFab (verified Oculus ID).
- Session validity: Worker (PlayFab ticket + session tracking).
- Ban status: PlayFab (server-side).
- Currency balance: PlayFab (server-side after fix).
- Inventory/cosmetics: PlayFab (server-side).
- Movement/position: Client (untrusted, heuristic detection only).
- Game state (scores, kills): Client (untrusted).
- Room state: Photon (relay, master client untrusted).
- Moderator status: PlayFab (server-side after fix).
- CCU: Worker (heartbeat-based).
- Audit log: Worker D1 (append-only).
Failure behavior:
- PlayFab down: fail closed for auth (deny new connections), fail open for gameplay (existing sessions continue), bans still enforced from cache.
- Worker down: Photon custom auth fails -> Photon denies connections (fail closed). Existing sessions continue.
- D1 down: audit log/flags delayed, core auth still works (worker validates via PlayFab directly).
- Photon down: game unplayable (no multiplayer). Single-player not affected.
Security guarantees and limitations:
- GUARANTEED: Currency cannot be minted (server-side grants). Bans cannot be bypassed (custom auth). Moderator status cannot be spoofed (server-side). Cosmetics verified against inventory. Version enforcement.
- NOT GUARANTEED: Movement exploits (detect only). Client-side visual mods (harmless). Master client abuse (minimize authority). Frida/injection (server-side limits blast radius).
- RESIDUAL RISK: A determined attacker can still cheat (movement, RPCs). Goal is detection + enforcement, not prevention.
================================================================================
Threat-to-defense matrix
================================================================================
(See research/ANTI_CHEAT_PREVENTION_DETECTION_MATRIX.md for full 18-row matrix.)
Key threats and defenses:
1. Modified APK -> Meta entitlement + version enforcement + server-side ban check.
2. Client-trusted currency -> Move grants to server-side (worker/CloudScript).
3. Moderator spoof -> Server-side role verification (PlayFab server data).
4. Ban evasion -> Photon custom auth ban check on connect + KickIfBanned (supplementary).
5. Movement exploits -> Heuristic detection (speed/teleport flags) + manual review. NOT auto-ban.
6. Cosmetic spoof -> Backend inventory verification + flag mismatch.
7. Leaderboard faking -> Server-side score validation or remove from leaderboard.
8. IAP bypass -> PlayFab PurchaseItem validates price server-side + server-side balance check.
9. Tag/Infection spoof -> Rate limit + ownership check + flag non-tagger RPCs.
10. Master client abuse -> Minimize master authority, move room state to backend.
11. RPC flood -> Per-player rate limits + flag.
12. Null crashes -> Guard null refs + server-side crash detection.
13. Duplicate session -> Heartbeat-based detection + kick older.
14. Version spoof -> Title data + custom auth version check.
15. Alt account ban evasion -> Hardware + IP overlap detection.
16. Attestation failure -> Flag + manual review. Do not auto-ban.
17. Frida/injection -> Server-side enforcement limits blast radius. Client detection = low-conf flag.
18. Memory modification -> Server-side validation of all valuable state.
================================================================================
Implementation roadmap
================================================================================
Stage 0: Close research gaps (1 week)
- Verify PlayFab UserData "Moderator" writability.
- Verify CloudScript/Azure Functions deployment.
- Verify PlayFab PurchaseItem price validation.
- Verify Meta attestation availability (if possible).
- Verify Photon custom auth configuration.
- Effort: 1 week. Risk: low.
Stage 1: Backend foundation (2-3 weeks)
- Cloudflare worker extensions: /validate-session, /heartbeat, /report-flag, /ban-check.
- D1 database schema (sessions, players, flags, bans, audit_log, ccu_snapshots, webhooks, detection_rules, evidence).
- Photon custom auth integration.
- PlayFab integration: validate session tickets, check bans.
- Acceptance: Photon connection fails for banned/invalid sessions; heartbeat tracks CCU.
Stage 2: Detection (2-3 weeks)
- Movement telemetry collection.
- Rules S-001, S-002, S-005, S-006, S-008.
- Flag creation with confidence + evidence storage.
- Review queue API.
- Acceptance: flags for synthetic cheats; no false positives on clean sessions.
Stage 3: Dashboard (2-3 weeks)
- Auth (email+password+TOTP), JWT, RBAC.
- Overview, players, flags, bans, audit log pages.
- Ban issue/revoke with Discord webhook.
- Acceptance: owner can log in, view flags, issue ban, ban appears in PlayFab.
Stage 4: Currency/cosmetic protection (1-2 weeks)
- Move currency grants to worker/CloudScript.
- Backend inventory verification for cosmetics.
- Acceptance: client cannot grant itself currency; cosmetic spoof flagged.
Stage 5: Testing & hardening (1-2 weeks)
- Pen test, load test (k6), false-positive regression, backup restore.
- Acceptance: all tests pass, no critical findings.
Stage 6: Controlled rollout (1 week)
- Staging with PCDEBUG (two-editor test).
- Limited QA rollout, monitoring, gradual expansion.
Total: ~9-14 weeks solo, part-time. Depends on Stage 0 findings.
================================================================================
Security test register
================================================================================
Unexecuted tests (all tests are planned, not executed):
- Authentication: invalid identity proof, arbitrary Custom ID, expired/revoked session, replay, account linking without proof, invalid Photon credentials, banned-user connection, backend outage, legacy client, wrong provider config.
- Authorization: self-promotion, unauthorized access, protected endpoints, invalid token, secret exposure.
- Economy: arbitrary currency grant, insufficient balance purchase, duplicate purchase, replayed redemption, invalid receipt, unowned cosmetic.
- Multiplayer: invalid RPC params, RPC flood, invalid tag/infection, client-controlled scene changes, unowned cosmetic props, master client changes, movement anomalies, telemetry limits.
- Reliability: worker outage, DB outage, quota exhaustion, auth service failure, session revocation, backup restore, compromised admin session, monitoring/alerts.
All tests are planned. None executed. No fabricated results.
================================================================================
Corrections made
================================================================================
1. Photon architecture: conflated "Photon" as single trusted component. Corrected: Photon Cloud is relay (semi-trusted), Master Client is player (untrusted), Photon custom auth delegates to backend (trusted). Dedicated server is v2+.
2. Meta attestation: earlier said "Layer One" as confirmed. Corrected: native symbol present (confirmed), API docs inaccessible (404). Availability UNVERIFIED. Optional module only.
3. Cost estimates: earlier said 10-17 weeks. Revised to 12-20 weeks (part-time). Final MVP: 9-14 weeks. Initial cost $1-35/mo (not $600/mo Tomahawk).
4. Tomahawk SDK: treated as "older snapshot" based on enum discrepancies. Ghidra confirmed: error counts stubbed, Photon.IsAvailable() returns false, TomahawkPhoton is stub. SDK is older/simplified.
5. Currency vulnerability: earlier said "client-trusted." Corrected: PlayFab AddUserVirtualCurrency validates session but NOT amount. Client can grant arbitrary currency. Worse than initially assessed.
6. Moderator status: earlier said "client-trusted." Corrected: PlayFab UserData "Moderator" key likely client-writable (default). If true, any player can self-promote. CRITICAL.
7. Master client: earlier didn't emphasize scene sync. Added: AutomaticallySyncScene=true allows master to force scene loads. Minimize master authority.
8. Detection rules: earlier had generic rules. Corrected: 12 ScreechVR-specific rules (S-001..S-012) derived from actual code.
9. Photon custom auth response codes: verified from official docs (0=incomplete, 1=success, 2=failure, 3=invalid params).
10. Free tier limits: added specific Cloudflare limits. Earlier were vague.
11. Heartbeat cost: 10s heartbeat = 864,000 req/day at 100 CCU (exceeds free tier). Revised to 30s heartbeat.
What was NOT corrected (still valid):
- Tomahawk public site research (features, pricing, roles, integration methods).
- Local file research (getting started, API reference, portal docs, unity implementation, error codes).
- Ghidra binary analysis (native lib is thin wrapper + OpenSSL).
- Quest modification threat catalog (comprehensive, verified identities).
- Trust boundary analysis (client untrusted, backend trusted).
- Detection engine design (risk scoring, graduated response).
- Dashboard design (pages, auth, security).
- Cost estimates (revised but directionally correct).
================================================================================
Unresolved questions
================================================================================
1. PlayFab UserData "Moderator" key: client-writable? (CRITICAL) - requires dashboard access.
2. CloudScript/Azure Functions deployed? (none in repo) - requires dashboard access.
3. PlayFab PurchaseItem validates price server-side? - requires dashboard/catalog config.
4. PlayFab bans enforced server-side? - requires dashboard access.
5. Meta attestation available? - docs gated (404), requires portal access.
6. Photon custom auth configured? - requires dashboard access.
7. "Allow anonymous clients" disabled? - requires dashboard access.
8. Dev/prod app IDs separate? - requires dashboard access.
9. SpokesSigmaIAP receipt validation - requires reading script + catalog.
10. GDH leaderboard anti-cheat - requires inspecting GDH package.
11. ATM_TAB currency flow - requires reading ATM_TAB.cs + Atm_Manager.cs.
12. D1 write throughput sufficient - requires load test (k6).
13. Free tier limits sufficient - requires monitoring post-launch.
14. AppEntitlementCheck intended behavior - requires verification.
15. Meta User Verification SDK compatibility with Unity 2021.3.32f1 - requires testing.
16. Data retention policy preferences - requires user decision.
17. Budget ceiling and solo-dev time availability - requires user decision.
18. Evidence storage needs (telemetry vs screenshots/video) - requires user decision.
================================================================================
Research activity log
================================================================================
Inspected during this pass:
- research/ (27 reports, README, FINAL_RESEARCH_SUMMARY)
- research/FINAL_SECURITY_ARCHITECTURE/ (26 deliverables)
- docs/screechvr-technical-map-2026-10-28.md
- docs/voideration-screechvr-architecture.md
- docs/voideration-anticheat-research.md
- docs/voideration-anticheat-review.md
- docs/QUEST_MODIFICATION_THREAT_CATALOG.md (in research/)
- SHARED-MEMORY.md, AGENTS.md
- Source files: Oculus_Login.cs, ScreechApi.cs, BuyCosmetic.cs, PhotonVRManager.cs (partial), Player.cs (partial), TagPlayer.cs, TagManager.cs, KickIfBanned.cs, AppEntitlementCheck.cs, UsernameValidator.cs, PlayerSpawner.cs, BestJumpscare.cs, GetCosmetics.cs, SecondaryCosmetics.cs, LevelSelect.cs, MapLoader.cs, Gamemode_System.cs, GamemodeManager.cs, Hand_Physic.cs, ScreechApi.cs
Documents reviewed (not modified):
- All 27 research reports in research/
- All 26 deliverables in research/FINAL_SECURITY_ARCHITECTURE/
- docs/screechvr-technical-map-2026-10-28.md
- docs/voideration-screechvr-architecture.md
- docs/voideration-anticheat-research.md
- docs/voideration-anticheat-review.md
- research/QUEST_MODIFICATION_THREAT_CATALOG.md
Documents created during this pass:
- research/FINAL_SECURITY_CORRECTION_BUNDLE.txt (this file)
- research/FINAL_SECURITY_CORRECTION/CORRECTION_INDEX.md (correction index)
What was NOT done:
- No implementation code written.
- No project files modified.
- No services deployed.
- No dashboard access.
- No tests executed.
- No credentials reproduced.
- No production data changed.
================================================================================
Source register
================================================================================
Official documentation:
- Meta Quest Attestation API: https://developers.meta.com/vr/documentation/native/ps-attestation-api/ (GATED - 404)
- Meta User Verification: https://developers.meta.com/vr/documentation/spatial-sdk/ps-ownership/ (GATED - 404)
- PlayFab login best practices: https://learn.microsoft.com/gaming/playfab/identity/player-identity/login/login-basics-best-practices
- Photon PUN custom authentication: https://doc.photonengine.com/pun/current/connection-and-authentication/authentication/custom-authentication
- Photon PUN host migration: https://doc.photonengine.com/pun/current/gameplay/hostmigration
- Cloudflare Workers pricing: https://developers.cloudflare.com/workers/platform/pricing/
- Cloudflare D1 limits: https://developers.cloudflare.com/d1/platform/limits/
- Cloudflare D1 pricing: https://developers.cloudflare.com/d1/platform/pricing/
- Cloudflare Durable Objects + WebSockets: https://developers.cloudflare.com/durable-objects/best-practices/websockets/
- Nakama authoritative multiplayer: https://heroiclabs.com/docs/nakama/concepts/multiplayer/authoritative/
- Unity upgrade guide: https://docs.unity.com/en-us/engine/7000.0/manual/upgrade-guides/upgrade-guide-unity63
- OWASP MASVS: https://mas.owasp.org/MASVS/
- OWASP API Security Top 10 2023: https://owasp.org/API-Security/editions/2023/en/0x11-t10/
- OWASP Cryptographic Storage Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html
Local research files:
- C:\Users\Void\Downloads\tomahawk stuff\ (all files, read-only)
- libTomahawkCore.so (5.3MB, SHA-256: 150710A0ED22048DDD3B18C49D7837EA60803B67DE768A6160DFF6A96ADD2B85)
Project files:
- E:\! Project Screech\! Screech VR\Screech VR\ (Unity project, read-only during research)
Confidence levels:
- Confirmed: verified against source code or official docs.
- Strong evidence: multiple sources agree, code partially verified.
- Plausible: reasonable inference, not verified.
- Historical: was true in the past, current status unknown.
- Unverified: cannot confirm, needs additional access/testing.
================================================================================
Final decision
================================================================================
Best free-first starting architecture:
Cloudflare Workers + D1 + KV + R2 (backend) + Cloudflare Pages (dashboard) + PlayFab (auth/inventory/bans) + Photon PUN 2 + Voice (networking). No dedicated game server for v1. No new providers. Extend existing infrastructure.
Best authentication model:
Meta User Verification (getUserProof, server-side) + PlayFab (persistent account) + Photon custom auth (room admission) + Voideration JWT (dashboard/API). Each token verified independently by its issuer.
Best long-term anti-cheat architecture:
Server-authoritative where possible (currency, bans, cosmetics, version) + heuristic detection for movement + manual review + private dashboard. Accept that movement exploits can only be detected, not prevented, without dedicated server. Migrate to Photon Fusion or dedicated server (v2) only if cheating becomes serious.
Five highest-priority vulnerabilities:
1. Client-trusted currency (AddCurrency local-first, PlayFab validates session not amount).
2. Client-trusted moderator status (PlayFab UserData "Moderator" key, likely client-writable).
3. Client-side ban enforcement (KickIfBanned polls every 5s, ignorable).
4. No movement validation (speed/teleport exploits, heuristic detection only).
5. Master client abuse (scene sync, room state manipulation).
Key costs:
- Initial: $1-35/mo (Cloudflare free tier + domain).
- 1k CCU: $20-50/mo (Cloudflare) + $95-500/mo (Photon, verify pricing).
- vs Tomahawk: $600/mo floor. Self-hosted saves $500-580/mo at 1k CCU.
- Trade-off: engineering time (9-14 weeks MVP, 5-10h/week ops).
Explicit statement: Research is complete. No implementation performed. No project files modified. No services deployed. No production data changed. Awaiting explicit approval before any code is written.
================================================================================
END OF REPORT
================================================================================
|
Pastebin