Gods Unchained

Gods Unchained is a competitive trading card game built on Ethereum Layer 2, enabling players to fully own, mint, trade, and manage their in-game assets. Unlike traditional free-to-play titles, digital ownership is central to the player experience.

That ownership model introduces additional security complexity.

Immutable required validation across:

• Blockchain-integrated item minting and trading flows
• Backend live services and API endpoints
• Multiplayer gameplay communications
• Web-based platform components
• Game launcher (Electron) and Unity client
• Registration, authentication, and voucher systems

When digital assets carry real ownership value, vulnerabilities in API logic, minting flows, or client trust boundaries can impact both gameplay fairness and asset integrity.

Immutable engaged Cyrex to fortify both the security posture and scalability of the ecosystem.

Cyrex conducted comprehensive white box penetration testing, reviewing internal implementations to assess logic, validation layers, and integration points in depth.

This allowed our engineers to analyze both traditional backend services and blockchain-connected gameplay flows.

Our assessment included detailed review of:

• Live services infrastructure
• API endpoint security
• Data handling and validation mechanisms

We evaluated how sensitive gameplay and asset-related interactions were processed server-side to prevent tampering or improper access.

In a competitive multiplayer card game, communication integrity is critical.

We assessed:

• Multiplayer “Mirror Message” communication flows
• Core gameplay logic validation
• Registration and authentication processes
• Tutorial completion logic
• Dungeon campaign flows (including successful, failed, retry, and consecutive runs)
• Hero summoning and merging
• Squad editing and management
• Voucher conversion mechanisms
• Item purchase and minting flows

Each system was evaluated for exploit potential, improper validation, or logic weaknesses that could impact progression or asset ownership.

Cyrex also reviewed:

• Web-based platform components
• Electron launcher security
• Unity client implementations

We assessed client-to-server trust boundaries and examined potential manipulation vectors within the launcher and game client.

In addition to penetration testing, Cyrex conducted load testing across multiple iterations, simulating tens of thousands of concurrent users.

This validation focused on:

• Backend service stability under concurrency
• API performance under sustained demand
• Gameplay session resilience during peak activity

The objective was to confirm that security hardening did not compromise scalability and that infrastructure could support growing player demand.