KILL TO EARN. DIE TO BURN.

2. Anchor Smart Contract Architecture

The program is written in Rust with the Anchor framework. All state lives in Program Derived Addresses, so account ownership is verified by the runtime rather than by application logic. Arithmetic is checked throughout; there is no unchecked add or subtract on any balance.

ACCOUNTS

• GameConfig — singleton at seed ["config"]. Holds the authority, rake in basis points, entry-fee bounds, match timeout, lifetime volume and accrued fees.
• PlayerProfile — one per wallet at ["player", wallet]. Career kills, headshots, wins, lifetime earned/lost, Elo, and the in-game SOL balance.
• GameMatch — one per match at ["match", match_id]. Escrow record, participants, status, result stats and the payout breakdown.
• Vault — a single program-owned PDA that custodies all deposited SOL.

INSTRUCTIONS UNAUDITED

• initialize / update_config — set rake, stake bounds and timeout. Rake is rejected above 1000 bps by the program itself, not by convention.
• register_player — creates the profile PDA. Once per wallet, ever.
• init_player_sponsored — creates the same PDA with the treasury paying the rent and the player not signing, so a first-time user needs no SOL of their own to exist on chain.
• deposit / withdraw — moves SOL between your wallet and the vault. Withdraw is user-signed; no authority can move a player's balance out.
• create_open_match / join_match — the 1v1 path. One player opens a match at a stake, the second joins; both stakes are debited into escrow.
• create_match — the team path. The full roster (2–10 wallets split across two teams) is known up front and every stake is escrowed in one instruction.
• cancel_match — creator reclaims a stake before anyone joins.
• timeout_match — permissionless. Anyone may crank a match the server failed to settle, returning stakes. This exists so a backend outage can never strand funds.
• settle_match_1v1 / settle_match — authority-only. Splits escrow, records stats, updates Elo, for the duel and team paths respectively.
• refund_team_match — unwinds a team match that cannot be settled, returning every participant's stake rather than leaving escrow stranded.
• withdraw_fees — moves accrued rake to the treasury.

ELO ON CHAIN

Rating is computed in pure integer arithmetic against a precomputed expectancy table. Floating-point powf compiles to soft-float on BPF: expensive in compute units and not guaranteed bit-identical across toolchains. Deterministic settlement requires integers.

3. Anti-Cheat & Match Integrity

A browser client is fully under the player's control. Any design that trusts what the client reports is not an anti-cheat design — it is an honour system with extra steps. HEXOPS is therefore built around a single rule: the client sends input, never outcomes.

WHAT RUNS TODAY SHIPPED

• Ed25519 wallet challenge–response at connect. Proves key ownership; proves nothing about play.
• Plausibility bounds on any submitted result — kill ceiling, minimum match duration, maximum kills per second, per-connection submission rate limits.
• Every rejection is written to a review queue rather than auto-banning. False positives cost a player their account; a queue costs a moderator a minute.

These are sanity checks, not anti-cheat. The numbers still originate on the client, and the code says so in as many words. Presenting them as more than that would be dishonest.

WHAT STAKING REQUIRES BUILDING

• Server-authoritative simulation. Movement, hit registration and damage resolved on the server. The client transmits key state and view angles only.
• Lag compensation with server-side rewind, so authority does not cost responsiveness.
• Server-side reveal. Positions of players you cannot legitimately perceive are never sent to your client, so a memory reader has nothing to read. The minimap already reflects this: enemies are invisible until a gunshot reveals the firing position.
• Statistical review of accuracy, reaction-time and flick distributions across sessions.

4. Matchmaking, Modes & Rating

Two modes, deliberately separated because they need different economics. Free-for-all is easy to collude in; team play is not.

QUEUE DESIGN PLANNED

• Matchmaking is server-side and random. You cannot select an opponent, which is what makes self-matching between your own wallets impossible rather than merely unprofitable.
• Pairing opens at ±150 Elo and widens over time so a thin queue still fills.
• Stakes are escrowed on queue and refunded in full on cancel, timeout, or a failed fill.
• A 5-second frozen countdown opens every match so no one loads in mid-firefight.

RATING

Players start at Elo 1000. Rating transferred to the winner is K × (1 − expected) with K = 32, always at least 1 point, and the loser never falls below a floor of 100. The transfer is symmetric: the winner gains exactly what the loser loses, so the pool neither inflates nor drains.

ANTI-FARMING SUMMARY