Economy Design Mistakes
Errors that break game economies.
No token sinks
Creating tokens without ways to remove them from circulation. Pure emission.
Exploitable reward formulas
Reward calculations that can be gamed through unintended strategies.
Uncapped minting
No limits on how many tokens can be minted in a time period.
Ignoring multi-accounting
Not considering that one person can have many accounts/wallets.
Smart Contract Mistakes
On-chain vulnerabilities.
Block hash randomness
Using block.timestamp or blockhash for game randomness.
Missing reentrancy guards on rewards
Reward claim functions without reentrancy protection.
Upgradeable contracts without safeguards
Upgradeable game contracts where single key can change everything.
No pause mechanism
Contracts without ability to pause during exploit.
Client Security Mistakes
Game client vulnerabilities.
Client-authoritative game state
Trusting client to report game outcomes, loot, or achievements.
Admin keys in client
Embedding treasury or admin private keys in game client code.
No anti-cheat
Game client without protection against memory editing or bots.
Unvalidated transaction parameters
Client generates transactions with user-controllable parameters not validated server-side.
NFT and Asset Mistakes
Errors with game assets.
Off-chain metadata tampering
NFT metadata stored on centralized server without integrity checks.
Asset duplication bugs
Contract bugs allowing same asset to exist twice or be minted multiple times.
Uncontrolled secondary sales
No consideration for how assets will be traded on secondary markets.
No asset freezing mechanism
Unable to freeze compromised or exploited assets during incidents.
Predictable token IDs
Sequential or predictable NFT token IDs enabling sniping.
Economy Balancing Mistakes
Errors in ongoing economy management.
No economic circuit breakers
Missing automatic halts when economy metrics go abnormal.
Static reward rates
Rewards that cannot adjust to player count or token price.
Ignoring whale behavior
Not accounting for players with massive resource advantages.
No fee adjustment mechanism
Transaction fees that cannot adapt to network conditions or token value.
Anti-Exploit Mistakes
Missing protections against common exploits.
No rate limiting on claims
Reward claims without cooldowns or rate limits.
Flash loan vulnerable pricing
Game asset prices based on single-block AMM state.
No slippage protection
Trades execute without maximum slippage parameters.
Timestamp manipulation vulnerability
Game logic relying on block.timestamp for time-sensitive features.
Integration Mistakes
Errors in blockchain integration.
Trusting on-chain data without indexing
Reading blockchain state directly in game loop, causing performance issues.
No transaction failure handling
Game assumes transactions always succeed. No retry or error states.
Wallet UX friction
Requiring signature for every action. Pop-ups for minor operations.
Incorrect chain event handling
Not handling chain reorgs or transaction replacements.
Insufficient error messages
Generic error messages that don't help players resolve issues.
Key Recommendations
Playtest your economy with adversarial players before launch.
Token sinks are as important as faucets. Plan both from day one.
Anti-cheat is a continuous effort, not a one-time implementation.