Fairness & anti-cheat

The server is the only authority

• Your browser sends four things: a point to move toward, split, eject and cash out. Nothing else is accepted.
• Positions, speed, mass, collisions, eliminations, cash-out timers and the leaderboard are computed on the server, 25 times per second.
• The browser never reports a kill, a balance or a finished countdown. A modified client can only send the same four inputs as anyone else.

Identical rules for everyone

• Your wallet balance has no effect on speed, starting mass, size or anything else in the arena.
• Everyone in a paid arena entered with the same amount.
• Paid arenas never contain bots. Practice bots use the same inputs as humans and are labelled.

Input validation and rate limits

• Movement targets must be finite numbers and are clamped to the arena. Speed comes from your cell size, not from your input.
• Split and eject cooldowns are enforced by the simulation.
• Messages are schema-checked, size-limited and rate-limited per connection. Floods are dropped, then disconnected.
• You only receive what is near your cells. The client cannot see the rest of the map, so a map hack has nothing to read.

Money moves once, in order

• Every kill and cash-out is written to a journal the moment the simulation decides it, then booked in a single database transaction.
• Events are processed strictly in the order the simulation produced them. Each has a unique key, so a repeated message changes nothing.
• A database constraint makes it impossible to record two eliminations of the same player session.
• The interface shows “balance secured” or a kill reward only after that transaction has committed.
• Every change of balance is an append-only ledger entry with a reference to the event that caused it.

What this does not solve

• Teaming. Players can cooperate, or one person can run several wallets and feed one of them. This build has no detection for it.
• Automation. A script can play through the same inputs a human uses. Rate limits cap its speed, not its skill.
• Latency. A slower connection means later reactions. The server treats all inputs equally on arrival.
• Operator trust. You are trusting the operator to run this code unmodified. Nothing on this page is enforced on-chain.