Reward Rush – Earn Rewards
Designing and building a rewards ecosystem enabling users to earn points through daily engagement activities — hardened with server-authoritative transaction validation, eliminating fake coin exploits, preventing replay attacks, and ensuring 100% financial integrity during reward redemptions.
Project Overview
Reward Rush is an Android rewards platform that allows users to earn coins through diverse engagement activities including offer walls, video watching, daily challenges, quizzes, and referrals. Because users redeem these accumulated points for actual financial rewards, the application was engineered with a strict, server-authoritative security model that safeguards the economy against balance tampering, fake coin generation, and replay attacks.
Goal: Build an engaging, high-retention gamified rewards ecosystem while guaranteeing complete financial ledger integrity and eliminating exploit vectors.
Problem Statement
Most reward apps suffer from confusing navigation and high churn, but their greatest existential threat is systemic fraud and exploit vulnerability. In open mobile environments, malicious actors often exploit client-side logic to artificially boost balances ("fake coin increase"), inject spoofed task completions, execute replay attacks on video rewards, or create automated bot referral rings.
The core challenge was two-fold: creating a fluid, addictive gamified user interface that drives engagement, while architecting an airtight, server-validated backend that blocks memory tampering, packet spoofing, and balance manipulation.
Objectives
- 100% Ledger Integrity: Migrate coin calculations to server-authoritative Cloud Functions, eliminating client-side fake coin manipulation.
- Anti-Cheat & Replay Prevention: Enforce cryptographic nonces and HMAC server postback validation for ad and offerwall rewards.
- Transactional Deduction Safety: Prevent double-spending and race conditions during coin redemption and percentage fee deductions using atomic transactions.
- Anti-Fraud Referral Gating: Detect emulator farms and device cloning to protect referral bonus payouts.
- Intuitive Gamified UX: Design engaging earning modules (video rewards, quizzes, daily bonus, offerwalls) with frictionless redemption flows.
Product Design Responsibilities
- Defined the reward ecosystem and user journey.
- Created onboarding and engagement flows.
- Designed referral and retention mechanisms.
- Mapped earning and redemption experiences.
- Prioritized features based on user value.
- Designed information architecture and navigation.
- Built interactive prototypes and user flows.
UI/UX Design Process
Research & Discovery
Conducted competitor analysis of popular rewards and earning applications to identify friction points in earning, engagement, and redemption experiences.
User Flow Mapping
Designed complete user journeys covering onboarding, dashboard, referrals, offer walls, tasks, and reward redemption.
Wireframing
Created low-fidelity wireframes to validate navigation and feature placement before visual design.
Visual Design
Developed a vibrant and engaging interface focused on clear reward visibility, gamification elements, and intuitive interactions.
Development Responsibilities
- Android Architecture & UI: Native Android development using Android Studio, Java/Kotlin, Material Design components, and responsive layouts.
- Server-Authoritative Ledger: Architected backend logic ensuring all coin balance mutations occur strictly on the server, removing vulnerable client-side write permissions.
- Anti-Cheat & Exploit Mitigation: Neutralized fake coin injections, memory modification scripts (GameGuardian/Frida), and packet replay attacks.
- Transactional Deduction Engine: Built atomic debit operations for reward redemptions and percentage deduction fee rules with race condition prevention.
- Firebase & Cloud Integration: Firebase Authentication, Firestore Database with locked security rules, Cloud Functions, and Firebase Cloud Messaging (FCM).
- Third-Party Ad & Offerwall SDKs: Integrated ad networks with cryptographic HMAC server postback validation to ensure authentic ad impressions.
- Production Release: ProGuard/R8 obfuscation, Google Play Console release management, and compliance checks.
Key Features
Zero client-side balance trust; 100% server-calculated balance ledger.
Earn verified points through cryptographic ad network callbacks.
High-payout offers with server-to-server webhook reconciliation.
Milestone-gated referral rewards with emulator detection.
Time-locked consecutive streak rewards with server timestamp sync.
Dynamic questions with server-side answer checking to avoid client leaks.
Real-time ledger updates, transaction history, and redemption stats.
Double-spend protected payout processing with automatic fee calculation.
Security Engineering & Bug Fixes
Hardening the Economy: Neutralizing Fake Coin Exploits & Fraud
Operating a rewards platform involving direct financial redemptions (gift cards, UPI, vouchers) made the app a prime target for reverse engineering, memory injections, and replay attacks. Below are the key security vulnerabilities analyzed, debugged, and architecturally resolved:
Fake Coin Increase & Client-Side Balance Manipulation
The Exploit: Malicious users armed with memory-modification tools (such as GameGuardian and Frida) or modified APK builds altered runtime variables in memory, or dispatched forged HTTP/Firestore write requests claiming inflated balances (e.g., jumping from 50 coins to 500,000 coins without doing tasks).
Root Cause: Early mobile architectures permitted direct Firestore document updates from the client app SDK, trusting the device to tally its own earned coin rewards.
Architectural Fix & Implementation:
-
Server-Authoritative Ledger: Completely stripped coin write permissions from client applications. The client can only trigger verified event requests (e.g.,
claimTaskReward()); balance calculations execute strictly in protected Firebase Cloud Functions. -
Firestore Security Rules Lockdown: Configured database security rules to
allow write: if false;on balance documents for all client tokens. Only backend admin SDK credentials can adjust user coins. - Cryptographic Task Handshakes: Task completions require ephemeral server-issued challenge tokens with cryptographic nonces that burn immediately upon reward allocation.
Percentage Coin Deduction Race Conditions & Double-Spending
The Exploit: When users submitted redemption requests or when percentage-based administrative coin deductions were calculated, rapid concurrent API requests or spotty mobile connectivity caused race conditions — allowing duplicate redemptions from the same balance or resulting in negative coin balances.
Architectural Fix & Implementation:
-
Atomic Transactions (
Firestore.runTransaction): Grouped balance verification, percentage deduction calculations, and coin debits into an atomic transaction that locks the user document during evaluation. - Strict Ledger Constraints: Ensured deductions instantly abort if available balance is lower than the required threshold, completely preventing overdraft or double-spend race conditions.
- Idempotency Keys: Assigned unique UUIDs to every redemption attempt, ensuring network retries never trigger multiple payouts.
Packet Replay Attacks on Video Ads & Offerwall Postbacks
The Exploit: Intercepting genuine video completion HTTP callbacks through proxy tools (Burp Suite, Charles) and replaying the exact payload repeatedly to credit thousands of unearned points without watching ads.
Architectural Fix & Implementation:
- HMAC-SHA256 Postback Signatures: Required ad network postbacks to include a server-to-server secret signature, verifying that requests originated from the genuine ad provider.
- Timestamp Windows & Nonces: Enforced a 60-second validity window and single-use transaction IDs in Cloud Functions, rejecting any replayed requests.
Automated Referral Loops & Emulator Multi-Accounting
The Exploit: Bot scripts running on PC Android emulators (Bluestacks, LDPlayer) mass-registered disposable accounts with mutual referral codes to farm signup coin bonuses.
Architectural Fix & Implementation:
- Google Play Integrity API: Integrated hardware attestation to detect rooted devices, virtual emulators, and tampered application package certificates.
- Engagement-Gated Referral Rewards: Referral points are locked until the referred account reaches genuine activity thresholds (e.g., minimum verified task completions), rendering empty bot accounts useless.
Firebase Token Expiration & Password Reset Handling
The Problem: Stale user tokens during extended gameplay sessions caused intermittent network failures during reward claiming, and unverified password reset callbacks resulted in credential desynchronization.
Architectural Fix & Implementation:
- Proactive Token Refresh: Built an automatic Firebase Auth token interceptor that refreshes ID tokens before executing high-value wallet transactions.
- Strict Auth State Handlers: Re-architected login and password reset flows with robust error handling for edge cases such as network dropouts or disabled accounts.
Technology Stack
Challenges & Solutions
Preventing Fake Coin Increase & Balance Exploits
The biggest existential risk was users hacking client-side code or memory to grant themselves free coins. I migrated the entire balance calculation and transaction pipeline to Cloud Functions and locked database rules, ensuring not a single coin could ever be credited without cryptographic server verification.
Eliminating Double-Spending on Redemption
Users triggering multiple rapid clicks or exploiting network lag during reward redemption could cause race conditions. I implemented ACID atomic transactions and idempotency keys to guarantee that deductions execute cleanly exactly once.
Sustainable User Retention Loops
Designed streak-based daily rewards, milestone referral tiers, and varied earning activities to maximize Day-1, Day-7, and Day-30 retention while keeping the rewards economy mathematically profitable.
UI Latency & Smooth State Sync
Implemented optimistic UI updates with background server reconciliation, giving users instantaneous feedback when completing tasks without sacrificing strict backend validation.
Results & Impact
- Zero Financial Discrepancies: Server-authoritative ledger completely blocked fake coin balance injections across all users.
- Airtight Redemptions: Processed real rewards with atomic transactions, eliminating concurrency race conditions and overdrafts.
- High Engagement & Retention: Combined gamification mechanics with smooth UX, driving consistent daily active usage.
- End-to-End Execution: Successfully designed in Figma and developed in Android Studio/Firebase for a Google Play Store deployment.
Key Learnings
This project was a masterclass in combining high-conversion consumer product design with rigorous financial security engineering. It reinforced that reward systems cannot rely on client trust: implementing server-authoritative state, atomic database operations, cryptographic verification, and hardware attestation is mandatory to build an economy that is both engaging for genuine users and impregnable to malicious actors.
Interested in working together?
If you need a gamified mobile application or a rewards platform designed and developed, let's connect.