When using IAP, the purchase receipt needs to be verified by the server against the store's verification interface, and the user's entitlements granted only after confirming the transaction is genuine and valid; releasing on the basis of a "purchase successful" returned by the client alone is easily bypassed by forged requests.