This absolutely is a concern with rollback networking (I have done a bunch of games in it). There are two ways you can cheat. Because you have the full simulat

This absolutely is a concern with rollback networking (I have done a bunch of games in it). There are two ways you can cheat. Because you have the full simulation state and input, there is no possible precaution against map hacks. Some FPS games just won't send exact player positions until the client is about to be able to legitimately observe them. Not possible here. The other way is, as you say, you can build fake inputs. To do the timing attack as you describe, all of your input would have to be pretending to be slow. You can't send a t=10 I'm idle packet, then a t=8 I blocked. You'd need a fantastic connection to the server, because the delay you're exploiting is there to protect you from your lag. Your oponent would also need a fantastic connection, because you aren't seeing their current inputs, you're seeing their past inputs. My feeling is that it would be very challenging to blend human like behavior with superhuman reflexes when doing automated responses. But there's nothing you're missing. The attack is definitely possible.