As usual, a simple MitM can accomplish more than you'd expect. Together with a simple Frida script, you can easily intercept traffic for apps with certificate pinning as well; there's no quick fix for a vulnerability like this.
You can't trust data from computers you don't own. Looking at the source code snippet posted, this library simply sends a "score" variable over a POST request and the server just seems to accept it as the real score; that's fine for keeping user-specific high scores, but as soon as you use that data together with any other account, you're going to have a bad time.
This reminds me of the Hive Social security vulnerability (forgetting to implement ACLs on any of their endpoints and doing all the security checks client side).
You can't trust data from computers you don't own. Looking at the source code snippet posted, this library simply sends a "score" variable over a POST request and the server just seems to accept it as the real score; that's fine for keeping user-specific high scores, but as soon as you use that data together with any other account, you're going to have a bad time.
This reminds me of the Hive Social security vulnerability (forgetting to implement ACLs on any of their endpoints and doing all the security checks client side).