Multiplayer exploits and how to fix them

In creating my RPG Base plugin, I’ve been thinking about possible hacks and how to stop them. Can anyone think of more?

Hack: Player lags, buildings don’t load in, player ends up inside building.
Solutions: Simulate movement on the server, where the buildings are loaded.

Hack: Player (somehow) loads loot chests before obstacles and enemies, can get to chests without needing to get in the building or defeat enemies.
Solution: For obstacles, simulate the movement on the server, somehow make sure the player has streamed in buildings before “lootables”. Not sure about how to ensure enemies are spawned.

And then there are item duplication exploits but I don’t even know how they work?

Multiplayer exploits is a gigantic topic and something every competitive multiplayer game is struggling with.

Your solution sounds like it could work.

You can’t be sure of anything on the client so I would probably just have a checklist for the client on the server that can allow or deny the client request to get the chest. Just be very careful that you don’t deny the clients legitimate attempts to get the chest so don’t make it too strict.