The technology under our games

Every result in our games comes from one small library. It is pure, synchronous and deterministic, and it runs unchanged on our servers and in the player's browser.

• Fixed-point integer math, so the server and the browser agree to the last unit
• Validators that return structured errors instead of throwing
• Rules versions stored with every round, so old rounds always verify
• 113 tests, including byte-for-byte reference vectors and large simulations

Read the write-up

Players can see inside. Each player has a committed server seed and a client seed they control; shared rounds use a pre-published hash chain salted with a future Solana blockhash.

• SHA-256 commitments shown before the first round
• Results from HMAC-SHA256 over public inputs
• A ten-million-link hash chain for shared rounds, published in advance
• A salt from a Solana block that did not exist when the chain was published

Read the write-up

Shared rounds, presence and chat run over a WebSocket gateway built to stay healthy when a few clients misbehave.

• WebSockets only, with 16 KB message caps and 25-second heartbeats
• Every connection takes an expiring lease before the handshake completes
• Per-address and per-account event budgets with one-second deadlines
• Events shared across instances, so capacity grows by adding servers

Read the write-up

There are no passwords. Players sign in with Sign In With Solana by approving a single-use message in the wallet they already use.

• Single-use challenges bound to the connection, valid for five minutes
• Every message field and the Ed25519 signature checked on the server
• Session tokens stored only as keyed hashes
• Optional authenticator-app codes with encrypted secrets

Read the write-up

Wallet keys never touch our application servers. They are generated and held in secure enclaves run by a dedicated key management provider.

• One credential per service, each with its own signing rules
• Policies that limit programs, destinations and amounts per transaction
• Two of three approvers for any change to users, keys or policies
• Hourly and daily caps on outgoing value

Read the write-up

Running live games takes tooling. Ours is built in: an operator console, monitoring and independent checks that compare our records with the chain.

• An operator console with a tamper-evident audit log
• Automated reconciliation of on-chain payments against our ledger
• Automated chat moderation that folds lookalike characters
• Edge protection and origin locking at Cloudflare

Fast finality and low fees are what make real-time on-chain games practical. We build directly on Solana and keep the rest of the stack small and well understood.

• Solana
• TypeScript
• Node.js
• Vue
• PostgreSQL
• Redis
• WebSockets
• Cloudflare
• Ed25519
• SHA-256