Forgot to mention that penetration is 100% handled server side.
If you let a client determine it locally it may not matchup with the servers. Have the server make the determination and multicast the data needed to simulate the effect on each client.
Demo
