Indeed, storing the state on the server only (still have to figure out what to do with no connectivity), and verifying receipts on the server will mostly get it fixed.

Isn't there a payment module for mobile apps on the appstore to prevent this happening for apps?

Wonderful post! This is definitely something every mobile app developer should be aware of.

Are there any figures regarding the magnitude of IAP hacking?

We're working on the perfect solution!

Interesting post! Thanks for sharing it.