Wallet safety & financial risk

Your account and wallet

• You sign in with a username and password. Your account comes with its own wallet on the site; you never connect an external wallet or sign anything.
• Deposit (Devnet): your wallet has a personal deposit address. Send Devnet SOL to it from any wallet or exchange and it is credited once the network finalizes the transfer.
• Passwords are stored only as salted scrypt hashes. There is no password reset in this build: if you lose the password, you lose access to the account.
• The site never asks for a seed phrase or private key of any wallet you own. Refuse any such request.
• In Devnet mode, never send mainnet SOL to your deposit address. It will not be credited.

This is a custodial system

Using Solana does not make this trustless. Deposited funds sit in a treasury wallet controlled by the operator. Your balance is a row in the operator’s database. Withdrawals are signed by a key the server holds. If the operator, the server or that key is compromised, funds can be lost.

• Withdrawals go to the Solana address you type in and require your password again. Anyone who knows your password can withdraw your balance, so choose a strong one.
• Per-request and daily limits apply, and the operator can pause withdrawals.
• Deposit-address keys are derived from a master secret in the server environment and are not stored in the database. The withdrawal key is read from the environment too. Neither is in the code or the browser.

How deposits are verified

• The server watches your deposit address itself on the configured network. Nothing your browser says is used for the amount.
• It must be finalized, successful, and must have increased the balance of your personal deposit address. The credited amount is that increase.
• Each transaction signature can be credited once, to one account.

How failures are handled

• A withdrawal’s funds stay reserved until the transfer is finalized. If it fails or expires, they return to your available balance.
• The transaction signature is stored before broadcasting, so a crash cannot produce a second payment for one request.
• After a restart the server replays its journal, then refunds any round that was still open.
• The server continuously checks that all balances add up against the ledger and reports any difference to the operator.

Your risks

• You can lose your whole entry and everything you have taken in a round, in seconds, to a better or luckier player.
• Outcomes depend on other players, your connection and your device.
• This software has had no independent security audit.
• Playing a game of skill for money is regulated or prohibited in many places. Whether a real-money version could be offered to you is a legal question this build does not answer.