The biggest problem here is a lack of server-side validation. The "remote champion" is determined by the score claimed by a client, so set a breakpoint in the function that posts the score and you can claim that any car parameters achieved any score... You see where this is going.

A proper implementation would run the simulation server-side to verify that a configuration achieves a high score. Almost as good would be to rank configurations based on the average runs across clients. This still lets a client submit an absurd configuration, but won't let an inferior configuration continue to be "champion".