Peer-to-peer networking is popular for good reasons. Players supply the hardware, there's no server build to maintain, and most engines ship samples that get a lobby running in an afternoon.

The cost shows up later, in who gets to decide what happened in a match. This article covers how cheating works in peer-to-peer games, what relays change, what they don't, and what actually moves authority out of players' hands. For the broader comparison of networking models, see Edgegap's guide to authoritative servers, relays and peer-to-peer.

Why Is Peer-to-Peer Vulnerable to Cheating?

Most peer-to-peer games aren't serverless. Michal Buras, then Lead Network Engineer at Highwire Games, described the usual setup in his September 2024 talk at Live Service Game Summit: "The game creates a listen server and with the public IP you connect all players to the server."

That listen server runs on one player's machine. That player is the host, and the host holds the match state.

So the problem isn't a missing authority. It's that the authority runs on a machine owned by one of the competitors. Other peers usually send their actions to the host, which checks them the way a server would. Nobody checks the host.

How Do Players Cheat in Peer-to-Peer Games?

The vectors that matter come from that ownership.

• Memory editing: The host can change values in its own process, such as health, ammunition, cooldowns or positions. Every other player receives the edited state as the truth.

• Lag switching: The host can cut their connection for a moment so everyone else freezes while they act, then reconnect. Non-host players can try the same trick, but the host decides how much delay the match tolerates.

• False results: The host reports the outcome. A host that reports a win it didn't earn is reporting it to the only machine that keeps score.

• A modified build: The authoritative logic ships inside the game build every player downloads. Anyone can decompile that build to learn how the host validates the match, then change it.

A dedicated server doesn't fix everything on this list in the same way. Lag switching is harder against a server, since the server sets the limits on how much delay it compensates for, but it doesn't disappear. Aimbots and wallhacks run on the player's own machine in any architecture, so they need a separate anti-cheat layer whether the game is peer-to-peer or not.

What Does Peer-to-Peer Cheating Really Cost?

Peer-to-peer saves on servers. The bill arrives in another form: cheaters and hackers.

Bloody Bastards, a mobile fighting game from Tibith Games with more than 40 million downloads, ran its multiplayer peer-to-peer. With no authoritative server, the host had to be trusted with match results. As co-director and developer Tibi Tircomnicu describes it, results "could be spoofed on that client and cheats were rampant in multiplayer."

The studio moved multiplayer to headless, authoritative dedicated servers. According to the studio, no hacker has managed to cheat since version 5.0.0. The full story is in Edgegap's Bloody Bastards case study.

For a competitive game, cheating isn't an isolated bug. Every match a cheating host wins is a match honest players lose, and the studio has no server-side record to check it against. Fixing it after launch means changing where authority lives, which is the work Tibith took on.

Beyond Cheating: IP Exposure and Leaked Data

Direct peer connections have a second problem. To connect, peers exchange IP addresses, which lets any player in a lobby target another with a denial-of-service attack.

Platform holders design around this. Valve's GameNetworkingSockets documentation notes that "on Steam we often do not share public IP addresses between untrusted peers, so that malicious players cannot DoS attack."

Data around the session can leak too. In his talk, Buras showed the lobby data of one AAA title on Steam being read with a common debugging tool:

"When you're making a peer-to-peer game, you usually gather relevant information on the player hosting the game, meaning on his PC, right? Using a simple application called Fiddler, you can access this lobby information store and expose all the other player's private information in plain text. And this app takes literally two clicks to install and can be used by a ten-year-old kid."

Michal Buras, then Lead Network Engineer at Highwire Games, Live Service Game Summit 2024

His verdict: "this is a massive amount of risk for a commercial game to bear."

Do Relays Stop Cheating?

No. They narrow the exposure compared with raw peer-to-peer, and that's where the benefit ends.

A relay server forwards traffic between players. Edgegap's glossary describes the limit: it "runs no game logic, so the game is still player-hosted peer-to-peer: one player's machine owns the match."

The gain is real on one front. "Your private address is not shared with anyone except the server which relays the information between you and the other player," Buras explained. Players can't target the people they're matched with using denial-of-service attacks, and players behind strict NATs can connect at all.

Everything in the cheating section above still works. The host still owns the state, still decides the result, and still runs a build anyone can decompile. A relay never sees any of it. It only forwards packets.

Fairness doesn't improve either. The host plays with no network delay, while "every other player's traffic takes two hops through the relay," per the glossary. "A relay server adds an extra node to your game packet that it has to pass through, which introduces latency," as Buras put it.

Adding checks to the relay doesn't change the category. "If you're computing, it's not a relay server anymore," Buras said. "It becomes a form of a dedicated server."

Which Option Fits Your Game?

Moving authority to a dedicated server closes the host-side vectors, because no competitor owns the machine that keeps score. It doesn't have to mean a full simulation. Edgegap's glossary describes four scopes, each costing more CPU per player than the one before.

The historical objection was cost and operations: reserved capacity per region, paid for whether players showed up or not. On-demand orchestration starts a server when a match is made, in roughly 3 seconds on average, across 615+ locations. A relay-style or multi-room server can run on a fraction of a vCPU, which brings its cost close to a relay's while keeping authority off player machines.

Peer-to-peer behind a relay still fits a narrow set of games: friends-only sessions with no ranked mode, no in-game economy and no strangers in the lobby, and deterministic lockstep games where every peer already runs the full simulation.

Conclusion

Peer-to-peer is free in compute and expensive in trust. The host owns the match, the rules ship to every player, and a relay changes the route without changing either fact.

Bloody Bastards shows the other side of that trade. Once a server the studio controlled held the results, spoofed results stopped being a multiplayer problem. Read how Tibith made the move in the Bloody Bastards case study.

—

This article cites the works listed below. All rights in the original content are owned by their respective owners.

• Michal Buras, then Lead Network Engineer at Highwire Games, Live Service Game Summit talk, September 10, 2024 (full transcript).

• Valve, GameNetworkingSockets P2P README, GitHub.

• Tibith Games and Edgegap, From Peer-to-Peer to Fair Fights: Bloody Bastards on Dedicated Servers, 2026.

• Edgegap glossary: peer-to-peer, relay server, dedicated server.