GameFi
GameFi Smart Contract Security Review
Continuous security review for on-chain games and reward economies, where randomness, payout accounting, and item minting are the attack surface.
Game contracts fail differently from DeFi: the bugs live in predictable randomness, payout rounding, and reward or item minting a determined player will grind until it breaks. Game teams also ship constantly, which is exactly why a single pre-launch audit stops describing their code within a month.
$300–600 one-time Onboarding Review, then ongoing review from $300/month. Your exact monthly price and turnaround are set after the onboarding review, against your real codebase and how often you ship.
- Medium
- Code4rena finding on Megapot
- Critical
- Finding on BulkSender
- 2 paid
- Audits: KoinArcade and BulkSender
- 3 disclosed
- Ronin projects: Fableborne, Apeiron, MoTZ
Several of these are Ronin ecosystem projects, because that is where a lot of small GameFi teams ship. The work itself is not Ronin-specific: the review covers Solidity and Vyper on any EVM-compatible chain, including Ethereum, Base, Arbitrum, BNB Chain, and Polygon.
Best fit for
On-chain games and play-to-earn economies with live contracts
Studios shipping new items, seasons, or reward mechanics on a regular cadence
Prediction markets and betting dApps where payout logic changes often
Small game teams on Ronin, Base, Polygon, or any other EVM chain
Focus areas
What I look at on this kind of codebase
Security and exploitability only. Gas optimisation, code style, and general code quality are explicitly out of scope.
Randomness integrity
VRF integration, commit-reveal schemes, and every source of entropy a validator, sequencer, or patient player can predict or influence.
Payout accounting
Rounding direction on wins, jackpot and bankroll solvency, and whether the contract can promise more than it holds.
Reward and item minting
Emission caps, duplication paths, and the crafting or upgrade logic that lets a player mint value out of nothing.
Game state transitions
Round lifecycle, refunds on cancellation, stuck games, and reentrancy through the callbacks game contracts so often rely on.
Economy changes between seasons
New drop rates, new reward curves, and new sinks reviewed against the economy already running, rather than in isolation.
Front-running and MEV
Actions that become profitable once the mempool is visible, and ordering assumptions your game logic quietly depends on.
Ronin ecosystem work
A lot of my published work is on Ronin, where I have made responsible disclosures to Fableborne, Apeiron and MoTZ. Ronin is EVM-compatible, so the review itself is not chain-specific, but knowing how game teams there actually build is.
Deliverables
What you receive
A reviewed diff before you deploy
Every contract change you submit is read for exploitability, along with each code path that reaches it, and comes back before the deploy rather than after.
Severity-rated findings with fixes
Each issue written up with impact, likelihood, the exact affected lines, and a concrete remediation step you can hand straight to a developer.
Proof-of-concept exploits
Where a finding is exploitable I include a reproducible test, so your team can confirm the severity in minutes instead of debating it.
A living map of your system
The trust boundaries, privileged roles, and invariants captured during the Onboarding Review are updated on every deploy, so the next diff is read against the code you actually have live.
How it works
How ongoing review runs
One baseline review at the start, then a loop that runs whether or not you are shipping. Steps three to five repeat for the life of the retainer.
- 01
Scoping call
A short call about what you have deployed and how often you ship contract changes. You leave knowing what the Onboarding Review will cost and when it can start.
- 02
Onboarding Review
A one-time $300–600 baseline read of your current codebase. I map the trust boundaries, privileged roles, value flows, and the assumptions your system relies on. This is also where your monthly price and turnaround are set, against real code rather than a guess.
- 03
A diff, or a quiet month
If you are shipping, you send the diff at least 3 business days before you deploy. If you are not, you send nothing and the retainer turns to the contracts already live. You never have to tell me which mode you are in — the absence of a diff is the signal.
- 04
I review it against your map
A diff is read for exploitability along with every code path that reaches it. A quiet month means your deployed contracts get re-read instead, checked against attack techniques that have become public since I last looked at them. Both are the same job against the same model of your system.
- 05
Findings back, map updated
Severity-rated, with a concrete fix for each, and I stay reachable while you patch. Whatever moved — your code or the set of known attacks — the assumptions map is updated so the next review starts from the current state. Steps three to five then repeat for as long as the retainer runs.
Pricing
What this costs per month
Two parts, in order. A one-time Onboarding Review that reads the code you already have live, then ongoing review of everything you ship after it. The Onboarding Review is where both prices stop being ranges and become your actual numbers.
Step 1 · required once
Onboarding Review
$300–600one-time
A baseline read of the codebase you already have deployed. It happens once, before any ongoing review begins, and it is where both the exact price for this step and your monthly price get settled against the real code rather than guessed from a form.
- Read of your current deployed contracts end to end
- A written map of trust boundaries, privileged roles, and value flows
- Severity-rated findings in the code you have live today
- A list of the assumptions your system depends on, which I then watch for breakage on every later deploy
- Your exact price inside the $300–600 range, set by codebase size and complexity
- Your monthly Ongoing Review price, quoted from what I actually found in the code
- Turnaround
- 5–7 business days
- Required
- Once, before ongoing review starts
Step 2 · ongoing
Ongoing Review
From $300/month
One offering with two triggers. When you are shipping, you send the diff and the changed code and everything it touches is reviewed for exploitability before it goes live. When you are not shipping, the same attention goes to the contracts you already have deployed: a periodic re-check of unchanged code against attack patterns that have become known since I last looked.
- Changed code and every code path it touches, reviewed before you deploy
- Periodic re-checks of existing contracts against newly known attack patterns
- Severity-rated findings with a concrete fix for each
- Proof-of-concept tests for anything exploitable
- Direct line to me for questions while you patch
- Exact price
- Agreed after the Onboarding Review
- Cadence and scope
- Set with you, not by deploy count
- Turnaround
- Agreed with you — usually 3–5 business days per diff
Ongoing Review starts at $300/month. Cadence and scope are agreed based on how often you ship and how much attention your existing contracts need, so a team shipping weekly and a team sitting on stable contracts are both covered by the same retainer. The final monthly price and your turnaround are set after the Onboarding Review, once I have read the actual code, rather than quoted off a fixed range up front.
Shipping faster than that? Shipping more often than a couple of times a month, or need a diff turned around faster than that? Say so on the scoping call and we will work out an arrangement that matches your deploy rhythm — there is no fixed menu here.
Changes above the Ongoing Review threshold
Quoted separately
New modules, new external protocol integrations, and major logic rewrites are not covered by Ongoing Review.
Ongoing Review covers incremental change to a codebase I already know. Work that adds a new module, integrates a protocol you were not previously exposed to, or rewrites core logic is a new scoped engagement, quoted on its own before it starts. I tell you a change has crossed that line when you send the diff, not after.
Scope is security and exploitability only
I review whether the changed code can be exploited, and what it breaks in the code it touches. I do not review gas optimisation, code style, naming, architecture preference, or general code quality. If something is inefficient but safe, I will not spend your review on it.
This is not a substitute for a full audit
Ongoing review catches what changes between deploys. It does not replace a full audit before a major version release or a public launch, and it should be paired with one. If you are launching or shipping a v2, book a full audit for that release — from me or from anyone else — and keep the retainer running around it.
Send diffs at least 3 business days before you deploy
Turnaround is agreed with you after the Onboarding Review and is usually 3–5 business days per diff, so a diff that arrives the morning of a deploy cannot be reviewed in time. Submitting late does not shorten the turnaround; it just means the deploy goes out unreviewed.
Large or complex changes fall outside Ongoing Review
New modules, new external integrations, and major logic rewrites are quoted separately as their own scoped engagement. Everything else — parameter changes, bug fixes, incremental feature work on existing contracts — is covered by the monthly fee. I flag the boundary when the diff arrives, before any extra work happens.
Ongoing Review runs for a minimum of 3 months
The retainer carries a 3-month minimum term. After that it continues month to month and either of us can end it with 30 days' written notice. The minimum exists because the first month is largely spent building context that only pays off over the following ones.
Your code stays confidential
Code, diffs, and findings are never published or shared without your written permission. An NDA can be signed before you send anything.
Prefer a single point-in-time review instead? One-time Full Audits start from $1,200.
The quoted price is the price
Your monthly number is set after the Onboarding Review, agreed in writing before the first month starts, and does not move inside the term. No hourly overruns, no scope-creep invoices, no surprise line items.
Confidential by default
Your code and findings are never published or shared without your written permission. NDA on request, signed before you send anything.
Get your next deploy reviewed before it goes live
Send me your repo, your chain, and roughly how often you ship contract changes. You get a monthly number and a start date back, usually the same day.
No obligation, and no sales sequence. Ongoing Review runs for a 3-month minimum, then month to month with 30 days' notice.
FAQ
Questions before you start
Do you audit smart contracts on Ronin?
Yes, and more of my public work is on Ronin than anywhere else. I have made responsible disclosures to three live Ronin ecosystem projects: Fableborne, Apeiron and MoTZ. Ronin is EVM-compatible, so Solidity contracts there are reviewed the same way as on Ethereum or Base. What Ronin adds is context: it is where a lot of small game studios ship, which means season mechanics, item minting and reward economies rather than pure DeFi.
Do you review gambling and casino contracts?
Yes. Randomness handling, payout accounting, bankroll solvency, and house-edge logic are a core focus. KoinArcade, an on-chain arcade with player payouts, is one of the published reports on this site.
How do you assess on-chain randomness?
I check the entropy source end to end: whether a validator or player can predict or influence it, whether the reveal can be withheld, and whether the outcome can be acted on before it is final. VRF integrations are reviewed for callback safety and request replay too.
Do you only work with Ronin projects?
No. Several published disclosures are to Ronin ecosystem projects — Fableborne, Apeiron, and MoTZ — because that is where a lot of small GameFi teams ship. The review itself covers Solidity and Vyper on any EVM-compatible chain, including Ethereum, Base, Arbitrum, BNB Chain, and Polygon.
What does ongoing smart contract review cost?
Two parts. A one-time Onboarding Review is $300–600, and it has to happen once before ongoing review starts. Ongoing Review then starts at $300 per month. The exact monthly figure is not a fixed range — it depends on how complex your codebase is and how often you ship, so it is agreed after the Onboarding Review, once I have read the actual code. Turnaround is agreed at the same point. Teams shipping more often, or needing diffs back faster, arrange that directly rather than picking a listed tier.
Is there a minimum term?
Yes. Ongoing Review runs for a minimum of 3 months, then continues month to month with 30 days' written notice to cancel. The minimum exists because the first month is largely spent building context about your system that only pays off over the following ones. The Onboarding Review is a one-time engagement with no term.
How is this different from a smart contract audit?
An audit is a point-in-time review of frozen code. Ongoing review reads what changes every time you ship. It does not replace a full audit before a major release or a public launch — pair the two, with an audit at the milestones and continuous review covering everything in between.
Other services
Ongoing smart contract review
A monthly retainer that reviews every contract change your team ships, instead of reading your code once before launch and never again.
One-time full audit
A single point-in-time audit of your codebase, delivered as a written report — the same work as the retainer, without the recurring component.
DeFi security review
Continuous security review built around the way DeFi actually fails: accounting drift, oracle assumptions, and incentives that pay attackers more than users.