Senior Penetration Tester (Gaming & Crypto)

We are looking for a Penetration and Security tester for a Casino project (per-project, part time)

Who are we?
Software Engineering company with expertise in FinTech and Blockchain. Strong software engineering culture. Fast development pace. We do things long-term. We build trust and relationships with employees and customers.

Required Skills

Gaming / Gambling Security

• Experience testing online casino platforms
• Experience testing lottery or raffle systems
• Experience validating provably fair implementations
• Understanding of RNG and cryptographic randomness
• Ability to identify methods for manipulating game outcomes
• Experience testing bonus abuse, referral abuse and promotional exploits
• Experience identifying methods to bypass betting limits and wagering requirements

Responsibilities

Casino Platform Assessment

• Attempt to exploit business logic flows that could allow players to:
  • manipulate game outcomes;
  • abuse bonus systems;
  • bypass wagering requirements;
  • duplicate winnings;
  • manipulate balances;
  • bypass betting limits;
  • exploit race conditions during betting;
  • perform multiple withdrawals;
  • abuse promotions, referrals or loyalty programs

• Test crypto and fiat wallet functionality including:
  • deposits;
  • withdrawals;
  • transfers;
  • balance consistency;
  • concurrency handling;
  • transaction validation

• Assess protections against automated bots, scripted abuse and account farming

Lottery Platform Assessment

• Validate the integrity of the lottery draw process
• Verify that the custom provably fair mechanism cannot be manipulated
• Attempt to predict, influence or replay lottery outcomes
• Test purchase workflows for duplicate purchases, payment manipulation and race conditions
• Verify prize allocation logic for both cash and physical item rewards
• Assess wallet integrity during ticket purchases, refunds and prize payouts
• Test against abuse scenarios including:
  • multiple simultaneous purchase requests;
  • replay attacks;
  • prize claim manipulation;
  • duplicate redemption;
  • account abuse;
  • automated purchasing bots.