My gut is telling me that you simply shouldn't allow the client to do anything that would alter the characteristics of object attributes on the server other than by calling well-defined actions such as "hit" or "run away." Granted, the server might need to send some values to the display, but it should not matter in the least if the client alters those values since it would result in an invalid display and the client would still be limited to interacting with the server by using only valid actions.

I think you would be much more concerned about securing access to the server so that clients could not alter the code itself that resides there. Along with such basic things as understanding how "taint" is your friend when dealing with input from sh...., uhhh, users.

Without having done any research right now, I would wager that there are several examples of game APIs on CPAN. I would look them up, especially those that deal with card games, and see how they address the issues you have brought up. Never forget the fundamental rule of programming: Don't reinvent the wheel, steal it! (Okay, I'm showing my age and Unix roots, but it applies more than ever today given how that is a primary goal of OO design.)