KILL TO EARN. DIE TO BURN.

2. Smart Contract Architecture

HexOps is a single Solidity contract (^0.8.24) on Robinhood Chain, an Arbitrum-Orbit L2 whose gas and stakes are both ETH. One contract holds everything: its own ETH balance is the vault, and vaultBalance() just reads address(this).balance. There is no separate vault account to fund, no storage rent, and nothing to keep alive — EVM storage is paid for once at write time and then simply exists. Arithmetic is checked by the compiler; there is no unchecked block on any balance.

The contract is not upgradeable and sits behind no proxy. That is deliberate: an upgrade key is a key that can rewrite the rules holding your money, and the honest way to remove that risk is to not have the key at all. What remains is the authority — the backend's hot key that creates and settles matches — and it is rotated in two steps (transferAuthority nominates, acceptAuthority is signed by the nominee), so a fat-fingered address cannot strand the contract.

STORAGE

• Config — one struct. Authority, pending authority, treasury, rake in basis points, entry-fee bounds, match timeout, the pause flag, lifetime volume and fees, and totalLiabilities.
• totalLiabilities — the sum of every player balance plus every live escrow, and nothing else. It is the provable amount the contract owes players, maintained on every movement rather than computed by iteration.
• players[address] — career kills, wins, lifetime earned/lost, Elo, the in-game ETH balance, the one-shot stake authorization, and any anticheat hold.
• matches[matchId] — escrow record, roster with teams, status, per-participant score and payout. Match ids are strictly increasing, so a settled id can never be reused.
• pendingTreasury — fees the contract tried to push to the treasury and could not. Pullable with claimTreasury(); see below.

FUNCTIONS UNAUDITED

• deposit() / withdraw(amount) — moves ETH between your wallet and the contract. Both are signed by you; no authority can move a player's balance out. withdraw is never pausable. A pause that traps money is a rug lever, so the pause flag gates deposit, authorizeStake, createMatch and settleMatch — and stops there.
• authorizeStake(maxStake, ttlSecs) / revokeStakeAuthorization() — player-signed consent to be staked, capped in size and short-lived (30 minutes maximum; the backend asks for ten). createMatch consumes it: one authorization, one match, then it is zeroed.
• createMatch — authority only. Debits each roster wallet's available balance into escrow. This is bookkeeping inside one contract, not a transfer, so totalLiabilities does not move.
• settleMatch — authority only. Credits every participant, losers included, updates stats and Elo, and takes the house's cut as the difference between the escrow and the sum of payouts — refused outright if it exceeds either fee ceiling. The fee is pushed to the treasury inside the same call; there is no sweep step and no fee sitting in the contract waiting for someone to remember it. If the treasury cannot receive ETH the amount goes to pendingTreasury rather than reverting, because a broken payout address must not brick settlement for the players in the match.
• voidMatch / refundTimedOutMatch — full refunds, no fee. The second is permissionless: once the match timeout has elapsed, anyone may call it. A backend outage can never strand an escrow.
• lockPayout / releasePayout — the anticheat hold. It is a reserve inside your own balance, and there is deliberately no function that can move a locked balance anywhere but back to its owner. A lock expires on its own: nobody has to send a transaction to free it, because available() simply ignores a lapsed one.
• receive() reverts. ETH enters only through deposit(), so nothing can land in the contract without a player record to own it.

UNITS

The contract works in wei because msg.value does, but it requires every amount to be a whole number of gwei. That is what lets the backend's ledger keep doing its money arithmetic in integers — a wei is far too small to fit a JavaScript safe integer, a gwei is not — so the mirror and the chain can be compared for exact equality rather than approximately.

ELO ON CHAIN

Rating is computed in pure integer arithmetic against a precomputed expectancy table. Floating point in the EVM does not exist and fixed-point rounding differs between implementations; deterministic settlement requires integers.

3. Anti-Cheat & Match Integrity

A browser client is fully under the player's control. Any design that trusts what the client reports is not an anti-cheat design — it is an honour system with extra steps. HEXOPS is therefore built around a single rule: the client sends input, never outcomes.

WHAT RUNS TODAY SHIPPED

• EIP-191 wallet challenge–response at connect: you sign a plain-text nonce, the server recovers the address. Proves key ownership; proves nothing about play.
• Plausibility bounds on any submitted result — kill ceiling, minimum match duration, maximum kills per second, per-connection submission rate limits.
• Every rejection is written to a review queue rather than auto-banning. False positives cost a player their account; a queue costs a moderator a minute.

These are sanity checks, not anti-cheat. The numbers still originate on the client, and the code says so in as many words. Presenting them as more than that would be dishonest.

WHAT STAKING REQUIRES BUILDING

• Server-authoritative simulation. Movement, hit registration and damage resolved on the server. The client transmits key state and view angles only.
• Lag compensation with server-side rewind, so authority does not cost responsiveness.
• Server-side reveal. Positions of players you cannot legitimately perceive are never sent to your client, so a memory reader has nothing to read. The minimap already reflects this: enemies are invisible until a gunshot reveals the firing position.
• Statistical review of accuracy, reaction-time and flick distributions across sessions.

4. Matchmaking, Modes & Rating

Three staked modes, deliberately separated because they need different economics. Free-for-all is easy to collude in; team play is not. SKIRMISH and DUEL are the same format at different stakes, which is the only bracket that means anything while the population is too thin for Elo to say much.

The dollar figures are indicative only: the stakes were set against ETH at roughly $2,500, and they are denominated in ETH, not in dollars. If ETH moves far enough that a SKIRMISH stops being pocket change, the ladder gets retuned — the numbers above are the current ones, not a promise.

QUEUE DESIGN PLANNED

• Matchmaking is server-side and random. You cannot select an opponent, which is what makes self-matching between your own wallets impossible rather than merely unprofitable.
• Pairing opens at ±150 Elo and widens over time so a thin queue still fills.
• Stakes are escrowed on queue and refunded in full on cancel, timeout, or a failed fill.
• A 5-second frozen countdown opens every match so no one loads in mid-firefight.

RATING

Players start at Elo 1000. Rating transferred to the winner is K × (1 − expected) with K = 32, always at least 1 point, and the loser never falls below a floor of 100. The transfer is symmetric: the winner gains exactly what the loser loses, so the pool neither inflates nor drains.

ANTI-FARMING SUMMARY