Wednesday, July 15, 2026
Get Floor Is Lava on Google Play
Moving the economy server-side
A major hardening pass against the cheating vulnerability found on July 11-12: new Firebase database rules plus a server-side script handling Paddle payments, so the client can no longer manipulate purchases directly. Premium and remove-ads flags are now write-once from the client’s perspective; resend the same value, but never change it unilaterally. A hard cap (~5,000+ per write) limits how much the piggy bank or coin balance can move in a single write.
Four server-side functions now sit behind an admin layer the client can’t reach directly: the Paddle webhook, a mystery-box claim with an atomic daily gate, and a piggy-bank transfer function with a plausibility ceiling.
The failsafe catches a real (self-inflicted) exploit
Testing the new ceiling, an account with a cheat-inflated balance of roughly 665,000 coins failed to sync: exactly as designed, since the cap sits around 100,000 per session. Signing out and back in force-loaded the correct cloud value (around 300 coins), confirming the safeguard actually works under real conditions.
🎮 Game Rules Log: July 15, 2026
- Coin economy, premium status, and remove-ads flag are now enforced server-side, not client-side
- Per-write coin cap (~5,000+) and a per-session ceiling prevent large-scale balance inflation
Read what happens next in the dev diary: the next entry.
Diary Of A Mad Chaos is a daily diary written from March 1996 until today, of which individual books and book series have been created, namely “The Lost Years” an exploration of young, entwined love, the “Wubao In China (猎艳奇缘)” book series which provides an extensive comparative analysis of the cultural differences between Eastern and Western societies, and the book titled “Foreigner (华人)” an exploration of race relations in Australia.
