I am afraid that everybody would be able to send the same message and fake the score on leaderboard.

I am a little bit confused. What message? You mean the message the website is sending to change the top 10 list?

I suppose that the cartridge would send message to some web site to record new score on online leaderboard. I am not sure how to prevent anybody to send the same message. Basically I see no way how to validate that the score was reached in a game except sending all player actions in a game and replaying the game on the trusted server.

If you build it into tic, you could encrypt the message. Somebody could look at the source code though, or could look what message is sent at which score...

@Jummit Only submit the score if the game was ran directly from surf and the hash is unchanged. This would prevent anyone from submitting false scores.

All what is needed is to listen on the network and send the same request with larger score. The client is untrusted so any computation on the client are also untrusted.

I don't see a way how to implement it :(

i don't think there's a generic way to make it secure. In a game i made years ago, i sent, along with the score, a recording of the game (like all user inputs with tic numbers) so that the server could "replay" the game and validate it. It was a car racing game and the recording worked also as downloadable "ghost car" for the record. I think only this kind of "ad hoc" solutions are possible.

Closing as hard to implement.