Server trusting client purchase totals in shop event

Found an issue where the server accepts whatever total the client sends in a purchase event. I'm seeing items get sold for less than their configured price when someone modifies the client call.

The event looks like this:

local QBCore = exports['qb-core']:GetCoreObject()

RegisterNetEvent('shop:buy', function(itemName, quantity, total)
    local player = QBCore.Functions.GetPlayer(source)
    player.Functions.RemoveMoney('cash', total)
    player.Functions.AddItem(itemName, quantity)
end)

Server validates the item name exists but trusts the total field completely. Client can send any number and it gets deducted from their cash. Normal UI purchases work fine since they calculate correctly, but a modified client can just send 1 as the total regardless of the actual item price.

Reproduced this by calling the event directly with a lower total value. Not sure what other fields might be safe to accept from the client - probably just the item name and quantity need validation against server-side pricing?