Multiplayer security: replay protection and packet validation

[robinwils]

Description

Harden the networking layer with replay protection, rate limiting, and per-action player verification. Current auth (PocketBase token) and AEAD encryption (AEGIS-256/ChaCha20-Poly1305) with serialization bounds checking are solid, but the application layer lacks replay detection (no sequence numbers), per-action player ID verification, rate limiting (client could spam actions), and periodic token refresh for long games.

Steps

• Add SequenceNumber (uint64_t) to NetworkEvent, track LastSeenSequence in PeerState, reject packets with seq <= last seen
• Add PlayerID field to BuildTowerPayload and SendCreepPayload, server verifies it matches sender
• Add per-peer rate limiting: max actions per tick, drop excess, reset counter each tick
• Consider periodic token refresh for games > N minutes
• Update fuzzer corpus entries for new packet format

[pipavlo82]

We’re testing a lightweight execution integrity layer for multiplayer match disputes.

Problem:
server logs are hard to trust during disputes ("edited?", "replayed?", "out of order?").

Approach:
build verifiable event receipts (event_id, prev_hash, payload, hash) and run deterministic verification:

• continuity mismatch -> FAIL
• payload tamper -> FAIL
• replay/duplicate event -> FAIL

Would this be more useful for:

1. anti-cheat escalation
2. support dispute resolution
3. tournament/fairness audits?