saw muneeb say the only way to fight AI hacks is to get better at AI defense. agreed, so heres what that has looked like for us so far, in case its useful to anyone else building small on stacks.
were a small anon team making genesis run 2, a free arcade shooter where maps and loot come from real bitcoin blocks. if a game says its fair, people should be able to check it, so we ran our own code past AI reviewers before anything touched real money.
what the AI reviews caught (before launch)
- a way to fake a huge score by editing what the browser sent the server
- an XSS hole in a backup-code screen
- a contract path where the owner could disqualify every winner and then take the refund. we couldnt fully remove that one on testnet, so its disclosed on our fair page instead of hidden
- an off-chain helper that approved payouts by run id only, so a hacked server could swap the wallet
we ran a second, independent AI pass after the fixes, and it still found 4 blockers. one pass is not enough.
what a human caught that the AI missed
Carlos from Zealynx read our forum thread and found timing problems in how we pick the daily bitcoin block: a miner’s clock could pull a block into the wrong day, and the first weekly seal would accept any past week. both are fixed now, and fairplay-board-v2 on testnet has the fix.
so our takeaway is to use AI for coverage and speed, and then still ask real people to read your code. the AI found more issues, but the human found the ones that mattered for fairness.
what anyone can check today
every loot drop has a CHECK THIS ROLL button. the check page redoes the roll in your browser from the bitcoin block hash and sends nothing anywhere: playgenesis.run/testnet
an offer
if youre building something small and open source in clarity and want a free extra pass, reply here. we run the same AI review on it and send what we find to you privately, not in public. no strings attached and nothing to buy. we know how stressful a public bug report can be.