Cheating in multiplayer games can feel like one big problem. It's really several smaller ones, and they live in different places.

Some cheats depend on who owns the match. Others run entirely on the cheater's own machine. Mixing the two up is how studios end up expecting a server to stop an aimbot, or expecting anti-cheat to stop a host from reporting a fake win. This guide sorts them out. For the cost side of peer-to-peer, including what relays do and don't fix, see Edgegap's companion piece on P2P networking's hidden costs.

Who Owns the Match in a Peer-to-Peer Game?

Most peer-to-peer games aren't serverless. One player's game acts as the server while that player plays. Michal Buras, then Lead Network Engineer at Highwire Games, described the usual setup in his September 2024 talk at Live Service Game Summit: "The game creates a listen server and with the public IP you connect all players to the server."

That player is the host. The host holds the match state, checks what the other players send, and decides what happened.

Edgegap's glossary sums up the consequence in one line: "Whoever holds the match state can change it."

A smaller family of games has no host at all. In deterministic lockstep and rollback games, every peer runs the full simulation and exchanges only inputs. There, each client is trusted with its own inputs instead. It's a specialist design, found mostly in strategy and fighting games, and rarely what a team means when it says P2P.

Which Cheats Come From Owning the Match?

These are the cheats that peer-to-peer makes possible, because they all go through the host.

• Memory editing: The host can change values in its own process, such as health, ammunition, cooldowns or positions. Every other player receives the edited state as the truth.

• False results: The host reports the outcome of the match. Nobody else's machine keeps score.

• Economy tampering: If the game has an in-game economy, the host's machine is where purchases, drops and prices get decided. A host who controls that can mint items or change what they cost.

• A modified build: The authoritative logic ships inside the game every player downloads. Anyone can decompile it to learn how the host validates the match, then change those rules and host with the modified version.

• Lag switching: The host can cut their connection for a moment so everyone else freezes while they act. Non-host players can try it too, but the host decides how much delay the match tolerates.

Other players in a host-client game send their actions to the host, which checks them much as a server would. The problem isn't missing validation. It's that one competitor runs it.

Which Cheats Run on the Player's Own Machine?

A second group of cheats never touches match ownership. They read or drive the cheater's own copy of the game.

• Aimbots and triggerbots read where opponents are and move the crosshair or fire for the player.

• Wallhacks and ESP draw opponents the player shouldn't be able to see, using position data the game client already received.

• Input automation such as macros and scripted movement sends perfect inputs that look like a player's.

None of these care who hosts the match. They work against a peer-to-peer host, and they work against a dedicated server, because the game still has to run on the player's PC to be played.

A server can limit some of them. A wallhack can only show what the client was sent, so a server that withholds the positions of players who are out of sight leaves it less to show. That reduces the damage. It doesn't detect the cheater.

What Catches Each Kind of Cheat?

Two layers do two different jobs.

Server authority is the first layer. Moving the match onto a server no player controls closes every cheat that depends on owning the state. That's the reason competitive and economy-driven games move off peer-to-peer.

Anti-cheat is the second layer. Client-side anti-cheat looks for cheat software on the player's machine. Server-side detection looks for impossible inputs or statistics in what players send. That second kind needs a server in the first place, since a peer-to-peer host can't be trusted to report on itself.

The server also has to fit the game. The glossary puts it bluntly: "A shooter hosted like a card game cannot stop the cheats that matter to it."

What About IP Addresses and Denial-of-Service Attacks?

Direct peer connections have one more weakness that isn't a cheat at all. To connect, peers learn each other's IP addresses, which lets any player in a lobby target another with a denial-of-service attack and knock them out of the match.

Platform holders design around this. Valve's GameNetworkingSockets documentation notes that "on Steam we often do not share public IP addresses between untrusted peers, so that malicious players cannot DoS attack."

A dedicated server fixes this between players, since everyone connects to the server and nobody sees anyone else's address. The server itself is still a public endpoint, so its hosting provider's network protection matters.

Does a Relay Fix Cheating?

No. A relay server forwards traffic between players. It hides IP addresses and gets players behind strict NATs connected, but it "runs no game logic, so the game is still player-hosted peer-to-peer: one player's machine owns the match," per Edgegap's glossary.

Every host-side cheat above still works behind a relay. Adding checks to the relay doesn't keep it a relay either. "If you're computing, it's not a relay server anymore," Buras said. "It becomes a form of a dedicated server." The companion article covers relays in detail.

What Changes When the Server Owns the Match?

Bloody Bastards, a mobile fighting game from Tibith Games with more than 40 million downloads, ran its multiplayer peer-to-peer with the host trusted with match results.

Results "could be spoofed on that client and cheats were rampant in multiplayer."

Tibi Tircomnicu, co-director and developer at Tibith Games, Bloody Bastards case study

The studio moved multiplayer to headless, authoritative dedicated servers. According to the studio, no hacker has managed to cheat since version 5.0.0.

That's the first layer doing its job. Spoofed results depended on a player owning the match, and once the studio's server owned it, that route was gone.

How Big Does the Server Need to Be?

A dedicated server doesn't have to run the full game. For a card game or a casual co-op title, it can forward messages and check a handful of rules, or validate results and purchases while clients simulate. Edgegap's dedicated server glossary describes four scopes, from relay-style to full simulation, and the companion article compares them side by side.

The historical objection was cost and operations: capacity reserved per region and paid for whether players showed up or not. On-demand orchestration starts a server when a match is made, in roughly 3 seconds on average, across 615+ locations. Placing servers that close to players is what produced a 58% average latency reduction versus public cloud in Edgegap's AAA studio case study.

Peer-to-peer still fits a narrow set of games: friends-only sessions with no ranked mode, no in-game economy and no strangers in the lobby, and deterministic lockstep games where every peer already runs the full simulation.

Conclusion

Every cheat answers the same three questions. Who owns the match decides whether a host can rewrite it. Where the cheat runs decides whether a server can see it. What catches it is either server authority, anti-cheat, or both.

Peer-to-peer leaves the first answer with a player. A dedicated server takes it back, which is what ended spoofed results for Bloody Bastards. Read how Tibith made the move in the Bloody Bastards case study.