Mobile GameFi Development: Economy, Wallet, Anti-Cheat

Players find ways to farm tokens faster than designed — the GameFi market collapses. This is a standard Play-to-Earn problem: the economic model fails under load if the technical implementation has holes. We solve this at the architecture level: the client never calculates rewards, all events are server-verified, and cheaters are blocked before they do damage. If you face similar issues, contact us for an audit of your project. We have delivered over 20 GameFi projects where an off-chain model cut gas costs by 90% and doubled retention.

Client-Side Reward Calculation Is a Vulnerability

If the app itself calculates how many tokens the player earned and sends that number to the server, cheating is trivial via Charles Proxy or Frida instrumentation. Therefore, every game event must be verified server-side: the client sends game_session_id plus actions with a signed timestamp, and the server independently recalculates the result. This closes the primary attack vector.

NFT Ownership: Verify on the Server, Not the Client

If the game requires NFT ownership (character, land), the ownerOf(tokenId) check must be an eth_call to the smart contract from the server. The client can spoof the response. The server caches ownership with a TTL of 30–60 seconds via Redis to avoid exceeding RPC limits.

Why On-Chain Transactions for Every Action Are Impossible

Issuing tokens via an on-chain transaction for every game action is too expensive and slow. The working pattern is: off-chain balance in a database → periodic or on-demand claim → on-chain mint or transfer. A Claim button in the app requests a signed message from the server (EIP-712 typed data), the user confirms via WalletConnect or an embedded wallet, and the smart contract verifies the signature and transfers tokens. The off-chain model reduces gas costs by 90% compared to per-action on-chain transactions. For context, a single on-chain Ethereum transaction at peak can cost $5–50, while an off-chain operation costs fractions of a cent.

Embedded Wallet vs. External Wallet: What to Choose for P2E?

For casual P2E games, an embedded wallet (Privy, Thirdweb In-App Wallet, Dynamic) is better. Keys are distributed via Shamir Secret Sharing: shares with the provider, the user, and the device. Recovery requires m of n shares — eliminating a single point of compromise. The user never sees a seed phrase until they export it. On mobile: Privy iOS SDK, Thirdweb React Native SDK. Transactions are confirmed with a PIN or biometrics via LocalAuthentication or BiometricPrompt.

How to Ensure Economic Sustainability of P2E?

A dual-token model (governance token + utility/reward token) became the standard after the Axie Infinity collapse: the governance token with limited supply stores value, the utility token is inflationary and spent on gameplay. A smart-contract reward pool with vesting schedule pays rewards linearly, reducing selling pressure. On the client, there are two balances, two separate Claim flows with different transaction confirmations. We guarantee economic stability at the design and testnet testing stage.

Game Engine: Unity, React Native, or Flutter?

Unity with a native blockchain plugin is the standard for complex P2E games. Unity WebGL builds are not suitable for mobile — only native iOS (.xcframework) and Android (.aar) exports. Use Thirdweb Unity SDK or ChainSafe Web3.Unity for on-chain interactions from C#. For simple P2E games (clickers, idle games), React Native with react-native-game-engine or Flutter with flame are good choices. Blockchain integration via JSI or Flutter Platform Channel without performance loss.

Anti-Cheat on Mobile: Protective Measures

Basic layer: SSL pinning (prevents MITM via Charles), certificate transparency check, RASP (Runtime Application Self-Protection) via Guardsquare DexGuard (Android) or iXGuard (iOS). Root/jailbreak detection via RootBeer or DTTJailbreakDetection — not as a hard block, but as a signal for enhanced server monitoring. Gameplay anomalies: if a player does 200 taps per second on a clicker, it's a bot. Server-side analytics with Z-score deviation from the cohort median identifies suspicious sessions. To ensure your game is protected, contact us for a review of your current architecture.

What's Included in the Project

• Audit of game mechanics and economic model
• Design of smart contracts and server-side reward validation
• Development of the game core on Unity, React Native, or Flutter
• Integration of an embedded wallet or WalletConnect v2
• Implementation of the anti-cheat layer (SSL pinning, RASP, anomaly detection)
• Economic testing on testnet
• Publication on the App Store and Google Play, with compliance to gambling/finance requirements
• Technical support for 3 months after launch

How We Work: Stages

1. Analytics and design — we break down mechanics, economy, and tokenomics.
2. Development of smart contracts and server-side validation.
3. Implementation of the game core — Unity/React Native/Flutter with blockchain integration.
4. Wallet integration — embedded or external, depending on audience.
5. Anti-cheat layer — client and server protection.
6. Testnet testing — load the economy, verify all scenarios.
7. Mainnet deployment and store submission.

Timeline Estimates

A simple P2E clicker with an embedded wallet, off-chain balance, and a claim mechanic — 6–10 weeks. A full-fledged GameFi platform with a Unity game, NFTs, a dual-token economy, and anti-cheat — 3 to 5 months. Timelines are refined after an audit of your mechanics. The cost is calculated individually per project.

We have delivered 20+ GameFi projects; our engineers understand the nuances of blockchain integration, economic modeling, and anti-cheat. If you want your P2E game to avoid the fate of collapsed projects, get a consultation. Contact us to discuss your project.

Mobile App Monetization: IAP, Subscriptions, and Ad Mediation

An app with poorly implemented purchases loses money not because users don't want to pay, but because a StoreKit transaction hangs, Receipt Validation fails with an error, or restore purchases doesn't work — and the user writes to support or leaves a 1-star review. Our experience (over 7 years in mobile development) shows that proper monetization increases LTV by 30–60% within the first three months after implementation. Get a consultation on monetizing your app — we'll analyze the current model and find growth points.

Why StoreKit 2 is the Best Choice for IAP?

StoreKit 2 (iOS 15+) is a modern API with async/await and device-side verified transactions without a server. Transaction.currentEntitlements returns all active purchases. Key change compared to StoreKit 1: JWS signature verification on device via VerificationResult<Transaction> — no need to send receipt to server for basic validation.

But server-side validation is still needed for consumable purchases and fraud prevention. App Store Server API replaces the old /verifyReceipt endpoint. Webhooks via App Store Server Notifications v2 provide real-time events: SUBSCRIBED, DID_RENEW, EXPIRED, REFUND — without polling.

A typical mistake: not handling paymentQueue(_:updatedTransactions:) in the background for unfinished transactions. User bought a consumable, app crashed before finishTransaction — purchase remains in queue, restores on next launch and requires reprocessing on server. Without server idempotency — double crediting.

How Not to Lose Revenue on Subscriptions?

The subscription model requires tracking states: trial → active → grace period → expired → refunded. RevenueCat is the de facto standard for managing subscriptions in production. It abstracts StoreKit and Google Play Billing, providing a unified API, webhooks, cohort analytics, and A/B testing of paywalls.

Alternatives to RevenueCat include custom implementations with Adapty or Qonversion. Fully custom only if data must not leave the infrastructure or there is non-standard logic. We guarantee that webhook setup and subscription lifecycle event handling is done without losses — verified on projects with over 500k DAU.

Google Play Billing Library 6+ requires handling PurchasesUpdatedListener and explicitly calling acknowledgePurchase() or consumePurchase() within 3 days — otherwise Google automatically cancels the purchase and refunds. The average cost of such an error is a significant loss per user per month (based on our project data).

Ad Mediation: Boosting CPM via Bidding

Showing ads from a single source means losing revenue. Mediation (waterfall or bidding) requests ads from multiple networks and displays the best bid. Google AdMob is the foundation for banner, interstitial, rewarded ads. Mediation via AdMob Mediation or MAX (AppLovin) is the second de facto standard. MAX uses In-App Bidding — a real-time auction without waterfall. In practice, MAX yields significantly higher CPM than classic waterfall (depending on geo and audience). For example, for rewarded video in the US, the improvement can be substantial. With 100,000 rewarded video impressions per day, switching from waterfall to In-App Bidding can generate additional daily revenue.

ironSource (Unity Ads) has a strong position in the gaming segment, especially rewarded video. Mintegral covers the Asian audience well.

Setting up mediation requires ATT (App Tracking Transparency) on iOS 14+. Without requestTrackingAuthorization, ad CPM drops by 3-5 times for non-consenting users. SKAdNetwork and Privacy Manifest (iOS 17) are mandatory requirements; without them, review fails.

How We Implement Monetization: Step-by-Step Process

1. Current model audit — analysis of funnel, paywall, price tiers, and identification of bottlenecks.
2. Model design — choose type (subscription, consumable, non-consumable) and optimize price points.
3. IAP integration — set up StoreKit 2 / Google Billing 6, receipt validation, webhooks.
4. Ad mediation — connect 3-6 networks, configure waterfall or In-App Bidding, test fill rate.
5. Analytics and cohorts — integrate RevenueCat, Amplitude, or Firebase for LTV tracking.
6. A/B testing of paywall — use Remote Config for experiments without a release.
7. Launch and monitoring — 2 weeks of free support after launch, bug fixes by 24-hour SLA.

How to Design a Freemium Model and Paywall?

Freemium works when the boundary between free and paid is properly drawn. Too strict a paywall at the start — users delete. Too generous a free tier — no incentive to pay.

A technically sound pattern: server-side feature flags (Remote Config in Firebase or LaunchDarkly) control access to features. This allows A/B testing of paywall without a release, changing trial conditions, and running promotions.

Implementation at the code level: EntitlementManager — a single point for checking access to features, aware of subscription status, flags, and promos. No scattered isPremium checks throughout the code. Experience shows this approach reduces paywall-related bugs by 80% (confirmed on 30+ projects).

Scope of Monetization Work

• Current model audit — analysis of funnel, paywall, price tiers.
• IAP integration — StoreKit 2 / Google Billing 6, receipt validation, webhooks.
• Ad mediation — configure MAX / AdMob, connect 3-6 networks, test fill rate.
• Analytics setup — RevenueCat, Amplitude / Firebase, cohort analysis.
• Documentation — description of entitlements, restoration procedure, review checklist.
• Team training — analysis of typical mistakes, support recommendations.
• Guarantee — 2 weeks free support after launch, bug fixes by 24-hour SLA.

Estimated Timelines

Cost is calculated individually. We have been working in this field for over 8 years and have implemented monetization in over 40 projects — many of which passed App Store Review without a single rejection. Contact us for an audit or order a consultation — we'll tell you what growth points exist in your app.