Regarding Network Instantiate & Destroy

Does only the server have authority to use Network.Instantiate and Network.Destroy? Can clients use these functions?

If it is not only the server who has the authority to use these two functions, is there any way I can make clients not be able to use this–I think it could make hacking and messing up the game easy?

Everybody can use those methods, yes. Network.Instantiate could be kind of prevented by checking OnNetworkInstantiate on each prefab and check who’s the owner. If you only want the server to Network.Instantiate you could Destroy the object if it wasn’t the server. There’s no way i know to prevent Network.Destroy.

All in all Unity’s current networking solution (raknet) is quite vulnerable for cheating.

Unity is working on a new system at the moment. It’s not clear if there will be any security improvements though.