Security Testing

Monstrocity: Rampage

Client:Alpha Dog Games

Cyrex partnered with Alpha Dog Games to conduct black box penetration testing for Monstrocity: Rampage, securing mobile gameplay systems, premium currency mechanics, and progression logic across iOS and Android.

The Challenge

Securing a Mobile Builder with Premium Currency & Timed Mechanics

Monstrocity: Rampage is a mobile city-building and monster-management game where players gather resources, construct buildings, and create powerful creatures for battle. The game’s progression model relies on:

Timed building mechanics
Premium currency purchases
Limited builder slots
Battle rewards
Monster creation and upgrade systems

In mobile builder games, vulnerabilities in resource timers, premium currency handling, or reward systems can significantly disrupt game balance and monetization integrity.

Alpha Dog Games required a real-world security evaluation across both iOS and Android, simulating attacker behavior without internal access.

The Cyrex Solution

Black Box Penetration Testing Across Mobile Gameplay Systems

Cyrex conducted structured black box penetration testing, emulating real-world exploitation attempts across both mobile platforms.

Our objective was to identify vulnerabilities in progression, monetization, and battle systems before they could be abused in production.

Gameplay & Progression Assessment

The engagement included testing of:

Building resources (time-based and resource-based mechanics)
Premium currency shop
Builder unit limitations
After-battle reward distribution
Monster creation and upgrade logic
Battle replay systems
Building placement and location mechanics

We evaluated whether gameplay actions were properly validated server-side and resistant to client-side tampering.

Mobile-Specific Validation

Because the title runs on both iOS and Android, we assessed:

Client-server communication integrity
Resource manipulation attempts
Timer bypass scenarios
Currency modification attempts

The objective was to ensure that critical mechanics — especially premium currency and timed systems — could not be exploited through packet tampering or local manipulation.

Iterative Testing & Remediation

Following the initial testing phase, Cyrex identified several critical vulnerabilities affecting gameplay integrity.

We delivered:

Comprehensive reporting
Clear remediation guidance aligned with best practices

After patching, Alpha Dog Games engaged Cyrex for an additional testing iteration to secure a new version. Regression testing ensured vulnerabilities were resolved and no new weaknesses were introduced.