🛡️ Anti-Cheat

Server-side fraud detection, rate limiting, and audit flagging built into every economy operation.

How It Works

Every economy API call passes through a guarded wrapper before executing. The anti-cheat system validates the request, checks rate limits, detects suspicious patterns, and flags anything unusual for review — all before the actual transaction runs.

HTTP Request → Auth → Anti-Cheat Guard → Rate Limit → Validation → Execute → Response
                                ↓
                         Audit Flag (if suspicious)

Rate Limiting

Per-player rate limits are enforced on economy operations using a sliding 1-minute window. When a player exceeds the limit, the request is rejected and an audit flag is created.

These are per-player limits, not per-API-key. A game with 1,000 players gets 1,000 × 60 = 60,000 operations/minute across all players.

Laundering Detection

The system monitors currency transfers between players. If two players transfer currency back and forth rapidly (A→B→A patterns), it flags the activity as potential laundering.

Default threshold: 5 transfers between the same pair within 1 minute triggers a warning flag. The transfer still executes, but it's flagged for review.

Transaction Validation

Before any economy operation executes, the system validates:

• • Positive amounts — negative or zero amounts are rejected
• • Max transaction amount — amounts over 1,000,000 (configurable) are rejected and flagged
• • Velocity checks — if a player's recent grants are 10× above the game average, a warning flag is created
• • Negative balance detection — if a wallet somehow goes negative (impossible state), a critical flag is raised

Idempotency Keys

Prevent duplicate transactions by sending an idempotencyKey with grant, spend, and transfer requests. If the same key is sent again within 24 hours, the request is deduplicated (returns the original result without executing again).

curl -X POST https://gameplaygen.com/api/economy/grant \
  -H "Authorization: Bearer gg_live_sk_..." \
  -H "Content-Type: application/json" \
  -d '{
    "externalId": "player_42",
    "currencyId": "gold",
    "amount": 100,
    "idempotencyKey": "quest_42_reward_abc123"
  }'

This is critical for retry-safe integrations. If your server crashes after sending the grant but before recording success, retrying with the same key won't double-grant.

Audit Flags

Suspicious activity creates audit flags with two severity levels:

Review flags via the GET /audit-flags endpoint or on the dashboard. Each flag includes the player ID, reason, context (amounts, thresholds), and timestamp.

{
  "severity": "warning",
  "reason": "Rate limit exceeded: grant (62/60 per minute)",
  "playerId": "j97def...",
  "context": { "action": "grant", "count": 62, "limit": 60 },
  "resolved": false,
  "createdAt": 1708700000000
}

Configuring Thresholds

Anti-cheat settings are configurable per game via the Convex dashboard or SDK. All settings have sensible defaults.

// Configure via Convex mutation
await ctx.runMutation(api.economyAntiCheat.configureAntiCheat, {
  gameId,
  rateLimits: { default: 120, craft: 20 },
  maxTransactionAmount: 5_000_000,
  launderingThreshold: 10,
});

Source Tagging

Every transaction is tagged with its source (server, client, craft, loot, marketplace, etc.) in the metadata. This helps distinguish legitimate automated transactions (like crafting outputs) from direct API calls when reviewing flags.