They could edit the numbers with a memory editor. As a general rule of thumb when writing code, pretend that all of your clientside code can be changed by a hacker. You should always validate the data on serverside (or hide it somehow) if it's important enough that it will be changed.