SYSTEM ARCHITECTURE
The live system is a FunFair-style state-channel casino settling on Arbitrum One. A player deposits RUSD; the operator allocates house float from its balance sheet (backed by a slashable HouseBond). Gameplay is entirely off-chain: dual-signed EIP-712 ChannelStates, one per action. The chain is the court, not the table — it only sees open, optional checkpoints, and close/dispute.
THE CONTRACTS
| CONTRACT | ROLE | ADDRESS |
|---|---|---|
| ChannelManager V3 | Escrow + channel registry + dispute court. Holds player deposit and house allocation; verifies dual EIP-712 signatures; enforces the checkpoint nonce floor, challenge windows (10 min ≤ 100k RUSD, 24 h above), reveal verification against hash-chain roots, fraud proofs via the rules verifier, reclaimStale (30-day permissionless escrow release), and the fee waterfall at close. | 0xe13DC056111906aA4d3659880EBDC67138c76DA7 |
| GameMuxVerifier | 45-line action-range dispatcher registered as the manager's single verifier: actions 0–31 route to blackjack, 32–63 to roulette (local = action − 32). A payload of one game can never validate under the other game's rules. | 0x14155583112F87777B95AB0EA76786bf079c6A83 |
| BlackjackRulesVerifier | Pure-function referee for blackjack (ENHC, S17, BJ 3:2, double any two, split once). Given two consecutive game states + reveals, decides deterministically whether the transition was legal — this is what makes disputes objective. | 0xFdcCE2DE2F8A28cBBdBaB01131C3bab138Eb9293 |
| RouletteRulesVerifier | European single-zero roulette: BET/SPIN state machine, 13 bet types (straight/split/street/corner/six-line/dozen/column/even-money), exact casino payouts 35/17/11/8/5/2/1:1, per-bet solvency check so a spin can never underflow the house balance, 1.25% fee on lost gross. | 0x5239969ff32e5733F319d3e80eD64D19adF4962f |
| HouseBond | Slashable operator stake (currently 2 × 100k RUSD). Pays player compensation on house liveness faults — max(2× open gross, 5 RUSD) — plus an equal penalty burned. 7-day withdrawal delay; pending withdrawals remain slashable; only the manager may slash. | 0x37E41E1d1EE2F96cE0203af06d639448547ade84 |
| IRulesVerifier | The 51-line interface that makes the manager game-agnostic. Any game whose rules can be expressed as a deterministic pure verifier can plug in — see the SDK docs. | — |
EXPOSURE CAPS & LIMITS DERIVATION
Per channel the manager enforces: Σ allocations ≤ 10% of vault float (EXPOSURE_TOTAL_PPM 100,000), single allocation ≤ 1.5% of float (EXPOSURE_SINGLE_PPM 15,000), and 8 × maxUnitStake ≤ allocation — the worst blackjack hand (split + double both hands, win both) can never exceed the channel's collateral. The roulette node enforces the same bound per spin: worst-case payout over all 37 numbers ≤ 8 × maxUnitStake.
The table limit offered at open is the minimum of three clamps, in order:
- Bond headroom: operator's slashable bond / 32 (the contract requires slashable ≥ 2 × comp × 8 × maxUnitStake headroom);
- Operator liquidity: operator wallet balance / 8;
- Float-derived cap: 1,733 ppm of vault float (the simulator-parity number: $520,000/hand at $300M TVL).
Live today: vault float ~10M RUSD → float cap ≈ 17,324 RUSD, but the 100k RUSD bond clamps first → maxUnitStake = 3,125 RUSD/hand, allocation 25,000 RUSD/channel. Raising the bond raises the limit automatically. We publish this rather than pretending the design-target number is live.
FEE WATERFALL
The channel accrues feeAccrued = Σ lostGross × 12,500 ppm (1.25% of gross lost by players — nothing on wins or pushes). At cooperative or forced close, the waterfall splits each hand's lost gross: burn 4,000 ppm → burnSink (RAIN buyback & burn), rebate 1,700 ppm → rebate pool, standby 500 ppm → Anchor Reserve, residual 6,300 ppm → vault. Arithmetically identical to the whitepaper's §4 decomposition of the 1.25% base spread; rounding always favors the vault. Conservation is asserted on every state: playerBal + houseBal + feeAccrued + grossAtRisk == deposit + allocation.
WHAT THE CHAIN GUARANTEES (AND WHAT IT DOESN'T)
- Enforced worst case: either party can always settle at the last dual-signed state; challenge windows + checkpoint nonce floors kill stale-state replays.
- Funds destinations: player payouts go only to the
playerOwnerwallet, never session keys; house payouts only to the operator. - Eventual liveness: if everything dies,
reclaimStalereleases escrow permissionlessly after 30 days of zero on-chain activity, at the last anchored state. - Not cryptographically preventable: selective stalling (the second revealer sees the outcome an instant early). It is punished instead — forfeits for players, bond slashing + compensation for the house — and the spec proves stalling is never profitable for either side. Spec §4.
- Inherited trust: Arbitrum One's sequencer and DA. The 24 h tier window vs the force-inclusion delay is an accepted risk at demo stakes, documented in the audit package.