GameFi Security Checklist

All game contracts should be audited before mainnet deployment.

If contracts are upgradeable, protect the upgrade admin with multisig and timelock.

Use Chainlink VRF or commit-reveal for randomness. Block hash is predictable.

Use checks-effects-interactions or reentrancy guards on mint/transfer functions.

Use Solidity 0.8+ or SafeMath for all arithmetic.

Only authorized addresses can mint, modify stats, or change game parameters.

Decide if metadata is mutable. If mutable, restrict who can change it.

Understand that on-chain royalties are not always enforceable on all marketplaces.

Protect against accidental burns. Consider requiring confirmation.

Ensure assets cannot be duplicated through contract bugs.

If assets bridge chains, ensure bridge is secure and verified.

Limit how many tokens can be minted per time period to prevent inflation exploits.

Prevent rapid reward claiming that could drain pools.

If using on-chain voting or prices, consider flash loan manipulation.

If using price oracles, ensure they cannot be easily manipulated.

Large instant withdrawals could indicate an exploit. Add delays or limits.

Detect and prevent automated farming that destroys economy.

Never trust the client for game outcomes, loot, or economic actions.

Verify all blockchain transactions through your backend before accepting.

Admin or treasury keys must never be embedded in game clients.

Memory editing, speed hacks, and automation should be detected.

Obfuscate client code to slow down reverse engineering.

Use WalletConnect, Web3Modal, or other standard connection methods.

Users should understand what they are signing. Clear transaction descriptions.

Request only the approvals needed. Avoid unlimited approvals.

Warn users about phishing. Provide official links and verification.

If using embedded wallets, implement proper session timeout and re-auth.

Prevent API abuse through rate limiting per user and IP.

Admin APIs require authentication and are not publicly accessible.

Player data and game state should be encrypted in storage.

API keys, private keys, and secrets use proper secrets management.

Log suspicious activity and set up alerts for anomalies.