The week we attacked our own game
Five parallel audits of our own economy - every way to mint gold, duplicate spends or complete a match twice, found and closed before players could.
Before real money goes anywhere near Glødkeeper, the economy has to survive its owner trying to rob it. So that’s what we did: five audit passes in parallel - reward economy, the auction house, mini-game score authority, account access, and the shard economy - each one played as an attacker.
The findings were humbling in the way they always are. The classic bug in games with currencies is the check-then-act race: the server checks you can afford something, then charges you - and if you fire twenty identical requests fast enough, all twenty pass the check before any of them charges. We found that shape in more places than we’d like to admit, including the auction house, where a well-timed double-refund literally printed gold.
Everything found was fixed the same week. The deeper fix was structural: every deduction now happens as one atomic guarded operation - the check and the charge are the same instruction, so there is no gap to race. The auction house was rewritten transactionally end to end. And match completion became a claim: exactly one request may ever settle a match, no matter how many arrive.
The lesson we kept: never trust the client, and never trust two reads of the same number to still agree.