Lua snippet

Server-Side Entity Lockdown Spawning

Lua

jakemilner· 20/08/2026

Avoids client-side vehicle spawning (which is vulnerable to injection exploits). The server creates the vehicle entity, assigns State Bags, and routes the network ID to the client.

Lua

-- SERVER-SIDE
RegisterNetEvent('core:server:spawnVehicle', function(modelHash, coords, heading)
    local src = source
    local ped = GetPlayerPed(src)
    local pCoords = GetEntityCoords(ped)

    -- Sanity check: prevent client from triggering distant spawn coordinates
    if #(pCoords - coords) > 20.0 then return end

    local veh = CreateVehicleServerSetter(modelHash, 'automobile', coords.x, coords.y, coords.z, heading)
    
    while not DoesEntityExist(veh) do Wait(0) end

    -- Set entity state bag & network ownership
    Entity(veh).state:set('owner', src, true)
    Entity(veh).state:set('fuel', 100, true)

    local netId = NetworkGetNetworkIdFromEntity(veh)
    TriggerClientEvent('core:client:vehicleReady', src, netId)
end)

Server-Side Entity Lockdown Spawning

Comments (0)