PlayerState vs. Character in a multiplayer game

I know there’re a few pros in storing state in the PlayerState Class vs. in the Character itself, but I’m unsure about a few things regarding when to use one vs. when to use the other.

Let’s pick the following scenario: we have a MOBA, where the character is owned by the controller (for RPCs, etc.) but actually controlled by an AI (for movement, etc.). As we know, most MOBAs have different characters, with different abilities and characteristics.

Given the above’s context, here you go my questions:

  1. In PlayerState, it’s appropriate to store HP (max and current), as well as Mana (max and current). But each character has its own max HP and mana. Currently, I’m getting these values from the character and manually setting them into the store, and everything that happens after the game starts is trusted by what’s in the PlayerStore–which is managed by the server,–and not in the character anymore. The issue is: this is prone to cheating, right? Because if we think about it, regardless of the state being managed by the server, a malicious user can open the client and change these max HP and mana BEFORE they are passed to the server, meaning that erroneously the server (through the state) will have manipulated values.
  2. I have a boolean called Is Attacking?, which is used by the State Machine to trigger a given animation. This is purely cosmetic because there’re no calculations towards it nor it affects the gameplay somehow. Currently, I’m storing it in the character itself, specially because I need it to trigger animations on my animation blueprint which has no knowledge about the controller. The question: is this fine? Should Is Attacking? belong to the PlayerState or having it in the character is a good choice? Also, other variables like Is Attacking? that are merely cosmetic are fine to keep them in the character? (By fine, I mean, safe and smart.)

That’s it. Thank you in advance.
*

(I had a third question which I forgot after writing the first two ones. Maybe an edit will come soon, or another topic.)

Here’s the answer for those who stumbled upon the same issue.