GameFi

GameFi & Gambling dApp Smart Contract Audit

A security audit for on-chain games, casinos, and reward economies — where randomness, payout accounting, and house edge are the attack surface.

Game contracts fail differently from DeFi. The bugs live in predictable randomness, payout rounding, and item or reward minting logic that a determined player will grind until it breaks. I audit for the player who reads your bytecode.

Get a fixed quote Book a free assessment call

3 yrs: Auditing EVM smart contracts
M-01: Verified Code4rena finding
Critical: Vulnerability found in BulkSender
Live: Disclosures to Ronin protocols

Best fit for

On-chain casinos, prediction markets, and betting dApps

Play-to-earn economies with mintable rewards or items

NFT games where item logic controls real value

Studios launching game contracts on Ronin, Base, or Polygon

Focus areas

What I dig into on this kind of codebase

Randomness integrity

VRF integration, commit-reveal schemes, and every source of entropy a validator, miner, or patient player can predict or influence.

Payout accounting

Rounding direction on wins, jackpot and bankroll solvency, and whether the contract can promise more than it holds.

House edge & bet limits

Max-bet enforcement against bankroll, edge calculation under edge-case inputs, and bets that can be cancelled after the outcome is knowable.

Reward & item minting

Emission caps, duplication paths, and the crafting or upgrade logic that lets a player mint value out of nothing.

Game state transitions

Round lifecycle, refunds on cancellation, stuck games, and re-entrancy through the callbacks games so often rely on.

Front-running & MEV

Actions that become profitable once the mempool is visible, and ordering assumptions your game logic quietly depends on.

Deliverables

What you receive

Severity-rated findings report

Every issue written up with impact, likelihood, the exact affected lines, and a concrete remediation step you can hand straight to a developer.

Proof-of-concept exploits

Where a finding is exploitable I include a reproducible test, so your team can confirm the severity instead of debating it.

Prioritised fix list

Findings ordered by what actually threatens funds first, so a short remediation window is spent on the right things.

Follow-up support

Questions about a finding or a proposed patch get answered while you are still shipping the fix, not after the invoice clears.

Methodology

How the review runs

01
Scoping call
A short call to walk through your contracts, chain setup, and deadline. You leave with a fixed price and a delivery date, not an estimate.
02
Manual review
Line-by-line reading of the codebase, then targeted analysis of the parts that hold value: accounting, access control, reward maths, and external calls.
03
Exploit testing
I write proof-of-concept tests for the paths I think break, so findings arrive with evidence attached instead of a maybe.
04
Report & remediation
A written report with severity ratings, reproduction steps, and a concrete fix for each issue. Then I stay reachable while you patch.
05
Retest & sign-off
On the Audit + Retest tier I re-review your fixes and issue a final sign-off report you can share with your investors or community.

Pricing

Fixed prices, published up front

Final pricing is confirmed after a brief scoping call based on actual contract complexity. Payment is arranged before the review begins, and the agreed number is the number you pay.

Introductory rates

These are introductory prices while I build out my library of public audit reports. They go up after the next five engagements — the rate you book at is the rate you keep for that engagement.

Code Review

€250

Single contract review, up to 200 lines.

One contract, up to 200 lines
Manual line-by-line review
Findings list with severity ratings
Remediation guidance for every finding

3 day delivery · 1 revision

Start with Code Review

Protocol Audit

€900

Full multi-contract audit with a written report and severity ratings.

Multi-contract codebase
Business logic and economic attack paths
Proof-of-concept tests for exploitable findings
Written PDF report with severity ratings
Remediation guidance for every finding
Follow-up support on questions

7 day delivery · 3 revisions

Start with Protocol Audit

Audit + Retest

€1,600

Full audit plus a post-fix retest and a final sign-off report.

Everything in Protocol Audit
Post-fix retest of your patches
Final sign-off report you can publish
Extended follow-up support

10 day delivery · 5 revisions

Start with Audit + Retest

Larger codebase

From €2,000

Protocols above roughly 1,500 lines, multi-module systems, or anything needing a longer engagement.

Quoted on scope after a call. Same process, same deliverables, same guarantees — the timeline and price just match the size of the job.

Get a scoped quote

No-findings refund

If the review surfaces nothing above informational severity, you get a full refund and keep the report anyway. You should not have to pay to find out there was nothing to find.

The quoted price is the price

The number agreed on the scoping call is the number you pay. No hourly overruns, no scope-creep invoices, no surprise line items after delivery.

Confidential by default

Your code and findings are never published or shared without your written permission. NDA on request, signed before you send anything.

Ship your protocol without wondering what you missed

Send me your repo, chain, and deadline. You get a fixed price and a delivery date back — usually the same day.

Get a fixed quote Book a free assessment call

No obligation, and a full refund if the review finds nothing above informational severity. If your scope is outside what I cover, I will say so on the call.

FAQ

Questions before you book

Do you audit gambling and casino smart contracts?

Yes. Randomness handling, payout accounting, bankroll solvency, and house-edge logic are a core specialisation, and I have published a full guide to gambling dApp security on this site.

How do you assess on-chain randomness?

I check the entropy source end to end: whether a validator or player can predict or influence it, whether the reveal can be withheld, and whether the outcome can be acted on before it is final. VRF integrations are reviewed for callback safety and request replay too.

How long does the review take?

Three days for a Code Review, seven for a Protocol Audit, and ten for Audit + Retest. The delivery date is agreed on the scoping call before any work starts.

When do I pay?

Pricing is confirmed after the scoping call and payment is arranged before the review begins. There are no hourly overruns — the agreed number is the number you pay.

Can I see an example report first?

Yes. The full BulkSender and KoinArcade reports are published on this site, so you can judge the depth and format before committing.