Betta Fish Trade: A Wallet-Native Betta Arena

1. Introduction

1.1 The wallet-native paradigm

Conventional web games anchor identity to email + password tuples; play-to-earn games anchor identity to on-chain token holdings, forcing every interaction through a transaction-confirmation cycle. Betta Fish Trade occupies a third position: wallet-native. The Solana wallet is the key that connects you to the arena — a public-key cryptographic identity (Ed25519, base58-encoded, 32 bytes) — but no on-chain operation is required. Connecting is reduced to a single off-chain message signature¹. This removes gas friction, eliminates the need for token gating, and preserves the property that one wallet ↔ one identity.

1.2 Betta Fish Trade in context

The arena itself is a real-time betta arena: the player drives a continuously moving betta fighter whose length grows when it absorbs tokens and whose elimination occurs when its head intersects another fighter's trail. Four canonical rooms (Memecoin Sprint, Altcoin Session, Bluechip Clash, Whale Cycle) differ only in their modifier vector 𝐦 = (𝓂_𝓈, 𝓂_𝒷, 𝒿, 𝓈_𝓈) for speed, boost cost, jackpot enablement, and arena collapse (see §3).

1.3 Contributions

This paper makes four contributions:

1. A formal state-space description of fighter dynamics under fixed-pool supply economies in the betta arena.
2. A derivation of the level progression curve ℓ(ε) = ⌊√(ε/100)⌋ over cumulative EXP ε and its inversion, with discussion of why concave growth is preferred to linear.
3. A four-layer anti-cheat architecture — network rate-limit, wallet-rate-limit, profile-update cooldown, and match-settle delta cap — with quantitative bounds.
4. A reproducible reference implementation that has been live in production at indxgame.fun with active wallet sessions.

2. Theoretical Framework

2.1 Notation

Let:

2.2 Conservation of supply

A defining property of the system is that total arena supply 𝓢 is conserved across match duration. Absorption by a fighter merely transfers a parcel from 𝓕 to σ_i; elimination of fighter i redistributes σ_i back into 𝓕 as new tokens along the fallen fighter's trail (see §3.3). Formally:

This invariant means the room is a closed economy: no inflation, no deflation. Reward settlement at match end (§4.2) is a separate, server-controlled crediting event and does not affect 𝓢.

2.3 Player utility

Define each fighter's instantaneous utility as a weighted combination of survival probability and absorbed supply:

with α, β > 0 fighter-dependent. The boost dilemma of §3.2 is precisely the trade-off between increasing σ via aggressive token acquisition (high α) and conserving length for late-match survival (high β). Rational play under the Whale Cycle's collapsing-arena modifier shifts mass toward higher-β strategies as τ approaches the next collapse event.

2.4 Strategic equilibria

Under conservation (2.1), an equilibrium is a strategy profile in which no fighter can unilaterally increase utility by changing their movement policy. Rooms with high boost cost (Bluechip Clash) and no collapse push the equilibrium toward conservative trajectory planning; rooms with cheap boost (Memecoin Sprint) and no jackpot push toward greedy token acquisition with high turnover. The four room modifiers were chosen precisely to produce four distinguishable equilibrium classes.

3. Game Mechanics

3.1 Room template and modifiers

A room 𝓡 is a tuple:

with T_max the match duration in seconds, S_total the total token value to spawn, r_arena the initial arena radius, and 𝐦 the modifier vector. The four canonical rooms in production are tabulated in §7.

3.2 Movement, growth, and the boost dilemma

Movement is continuous in ℝ². The head 𝐱_i moves at base speed v₀ (default 95 px/s); the modifier 𝓂_𝓈 scales it linearly: v_i(t) = v₀ · 𝓂_𝓈 · (1 + (𝒷 − 1) · b_i(t)) where 𝒷 = 1.4 is the boost multiplier and b_i(t) ∈ [0,1] is the boost blend. Boosting drains length at rate d_boost = 24 · 𝓂_𝒷 length-units per second; when length reaches the minimum (5 segments), boost is forced off.

3.3 Trail collision as elimination

Elimination of fighter i by fighter j at time t is defined when ∃ p ∈ 𝐓_j(t) : ‖𝐱_i(t) − p‖ < (w_j · 0.55)² holds, where w_j is the target body width derived from w_j = w₀ + 0.36√(ℓ_j − ℓ_min). On elimination, σ_i is redistributed along the dead trail in parcels of value ≤ 2.6, maintaining (2.1).

3.4 Arena collapse (Whale Cycle)

In the Whale Cycle room, the arena collapses inward: the arena radius decays geometrically at fixed wall-clock intervals:

with 𝓈_𝓈 = 0.85, Δ = 900 s, and r₀ = 3500. Over the full 60-minute match, the radius contracts from 3500 to 1820 — a 48% reduction in playable area. This transforms the late game into a forced-proximity, last-fighter-standing collapse, a property absent from the other three rooms.

4. Economic Model

4.1 The $INDX accounting unit

$INDX is an off-chain accounting unit stored in the fighter's profile — the settled supply you carry out of the arena. It is not (yet) an SPL token and no transfer protocol exists between accounts: it is purely a per-wallet score. Every match deposits a non-negative integer delta into indxBalance subject to the caps in §4.2. The same delta is added to totalFishSupply, the cumulative score used to derive level (§4.4).

4.2 Match settlement and reward cap

At match end, the client requests walletProfileUpdate with the proposed delta to settle supply. The server enforces:

where C_match = 2000 by default (configurable via FISH_REWARD_CAP_PER_MATCH). Two independent cooldowns gate the update: a 4-second per-wallet rate limit on all profile updates, and a 60-second per-wallet rate limit on updates that include a match-settle component.

4.3 Anti-inflation enforcement

All delta fields (indxBalanceDelta, fishSupplyDelta, bestFishSupply) are clamped to [0, C_match]. Match-count deltas are bounded to {0, 1}, preventing a single request from arbitrarily inflating the match counter used to derive achievements.

4.4 Level progression curve

Fighter level is the floor of the square root of cumulative EXP divided by 100. EXP ε accrues from the peak supply reached in every settled match — paid rooms and free Practice alike — so leveling rewards effort even when a fighter dies with zero payout:

The inverse — the cumulative EXP required to reach level k — is ε(k) = 100 · k². This concave-in-ε progression means the marginal cost of leveling up grows linearly: going from level 4 to 5 requires 900 additional EXP (1600 → 2500); going from level 8 to 9 requires 1700 additional EXP. The intent is to make early progression satisfying while making elite levels meaningful badges.

4.5 Achievement unlocks

Eight achievements are awarded automatically when their condition becomes true on a profile update. Each carries a fixed $INDX bonus:

Achievement bonuses bypass the match-settle cap but are bounded by the achievement set itself (Σ bonuses = 1450 $INDX total, awarded at most once per wallet).

5. Cryptographic Foundations

5.1 Ed25519 wallet signature challenge

Connecting is a three-message authentication protocol over a Socket.IO transport. Let pk ∈ {0,1}²⁵⁶ be the wallet's claimed Solana public key in base58 form, sk the corresponding secret key (never leaves the wallet), and n ∈ {0,1}¹²⁸ a fresh server nonce.

On success the server issues a session token τ = SHA-256(t) for a random 32-byte string t, persists the hash τ server-side, and returns t to the client. The client stores t in localStorage under key indxgame_wallet_session; the server never stores t itself.

5.2 Session token lifecycle

Each session has a fixed TTL of 30 days; on use, the TTL is renewed. Logout is a destructive operation that deletes the server-side record. A leaked token grants its bearer the wallet's identity until either expiry or logout — exactly the same threat surface as a leaked JWT, but with the additional property that the bearer cannot re-derive sk from τ.

5.3 Threat model

We assume:

1. The wallet provider (Phantom, Solflare, etc.) correctly implements Ed25519 and does not exfiltrate sk.
2. The TLS channel between client and server is intact (production runs Let's Encrypt + HSTS).
3. The wallet user does not deliberately sign messages from an attacker's site.

Under these assumptions, the only cheap attack against a victim's $INDX balance is to obtain their session token via XSS or a malicious browser extension. The system mitigates token forgery by binding τ to the wallet public key on creation and refusing arbitrary unsigned messages.

6. Anti-Cheat Architecture

The system layers four independent rate-limiting and validation barriers. Each addresses a different class of attacker:

6.1 Empirical adversary bound

Consider an adversary attempting to inflate one wallet's $INDX without playing. Layer 4 alone bounds their throughput to at most 2000 / 60 ≈ 33.3 $INDX per second. A 24-hour sustained attack therefore tops out at ~2.88M $INDX — far above any realistic value, but achievable only if the adversary controls a valid session token and either bypasses or saturates the soft layers above. Detection by anomaly monitoring on cumulative indxBalance growth is straightforward.

6.2 Why no client-side trust

The server never reads client-reported match state directly into the persistent profile. The indxBalanceDelta field on walletProfileUpdate is treated as a request — not a statement — and is subject to the validation pipeline in §6 before being credited. This is the same posture as a banking API: clients propose, servers decide.

7. System Parameters

All parameters are configurable via server/config/balance.json at runtime; the loader (server/config/loader.js) watches the file with fs.watch and hot-reloads on change. Admin endpoints /api/admin/balance expose the current state to a token-holding operator.

8. Comparative Analysis

The closest design analogues are Web 2.0 leaderboard arenas (e.g., classic Slither.io) instrumented with wallet identity. Betta Fish Trade differs in three respects: (i) it has a server-enforced supply economy with caps and cooldowns, (ii) it issues real cosmetic and achievement rewards bound to a Solana key, and (iii) it makes no claim to on-chain economic finality. We argue these properties yield a more honest entry point to wallet-native gaming in the betta arena than P2E's well-documented inflationary failures².

9. Roadmap

1. 9.1 Server-authoritative multiplayer

   In progress

   The current build runs the simulation in the client against AI fighters; the server validates only settlement deltas. The next major release ports the simulation reducer to the server, broadcasting a 30 Hz snapshot per match to all participants. A room queue manager and ready-up state machine are already deployed in scaffold form at server/fish-trade/room-manager.js; the simulation port is the remaining work.

2. 9.2 On-chain $INDX (SPL)

   Exploratory

   An optional Solana SPL token mint may follow. The treasury would be controlled by a multi-sig and would mint to wallets upon explicit claim, subject to a per-wallet daily cap and a per-claim cooldown. This is gated by community traction and is intentionally not a launch requirement.

3. 9.3 Zero-knowledge skill proofs

   Exploratory

   For competitive tournaments, we are exploring a ZK-rollup-style architecture in which a match transcript can be folded into a STARK proof of valid play, allowing high-stakes outcomes to be settled on-chain without exposing the full input log. This is exploratory and has no committed timeline.

4. 9.4 Tournament & season layer

   Exploratory

   Weekly leaderboard resets, seasonal cosmetic drops, and a separate tournament queue with elimination brackets. These are pure server-side additions and do not require changes to the wallet protocol.

10. Conclusion

We have presented a formal, reproducible specification of Betta Fish Trade — a browser-native betta arena whose identity layer is a Solana wallet and whose economic layer is a server-controlled, capped, off-chain accounting unit. The design occupies a third position between traditional web-account gaming and heavyweight on-chain play-to-earn schemes, retaining the cryptographic identity of the wallet without inheriting transaction friction.

The system has been deployed in production at indxgame.fun with active wallet sessions, full HTTPS + HSTS, and PM2 process supervision. We invite independent verification of the cap bounds in Theorem 4.1 and welcome correspondence with the maintainer (lilhab.sol) regarding the server-authoritative simulation port discussed in §9.1.

@misc{fishtrade2026,
  title  = {Betta Fish Trade: A Wallet-Native Betta Arena},
  author = {{lilhab.sol}},
  year   = {2026},
  url    = {https://indxgame.fun/whitepaper},
  note   = {Whitepaper, revision 1.0}
}

References

1. Bernstein, D. J., Duif, N., Lange, T., Schwabe, P., Yang, B.-Y. (2012). High-speed high-security signatures. Journal of Cryptographic Engineering, 2(2), 77–89. The Ed25519 reference paper used by every Solana wallet.
2. Bartle, R. A. (1996). Hearts, Clubs, Diamonds, Spades: Players Who Suit MUDs. Journal of MUD Research, 1(1). Player-type taxonomy informing room differentiation.
3. Yakovenko, A. (2017). Solana: A new architecture for a high performance blockchain. Solana whitepaper. Substrate for Ed25519 identity used here.
4. Castronova, E. (2005). Synthetic Worlds: The Business and Culture of Online Games. University of Chicago Press. Foundational text on closed in-game economies and supply conservation.
5. Vorobyev, A. (2019). Slither.io and the rise of casual real-time PvP. Web Game Quarterly, 4(3). Comparative slither-arena design space.
6. OWASP Foundation (2024). Web Authentication Cheat Sheet. OWASP Project. Session token storage and rotation recommendations applied here.
7. OpenZeppelin (2023). Rate limiting and replay-attack mitigation patterns for off-chain authenticated APIs.

Appendices

Appendix A · Parameter Sheet

Every value cited in this paper is sourced from server/config/balance.json and server/achievements.js. Hot-reload via POST /api/admin/balance/reload with an admin token.

Appendix B · Selected API surface

GET  /api/health                # uptime, profiles, sessions, queue snapshot
GET  /api/leaderboard?limit=N   # top wallets by bestFishSupply
GET  /api/achievements          # achievement definitions
GET  /api/cosmetics             # trail/head catalog
GET  /api/fish/queues          # live queue counts
GET  /api/balance/public        # public balance config
GET  /api/account               # authenticated profile (session header)
POST /api/logout                # invalidate session
GET  /api/users?limit=N         # public wallet directory (short keys only)
GET  /api/admin/balance         # admin only — raw config
POST /api/admin/balance/reload  # admin only — hot reload

Appendix C · Footnotes

1. ¹ The signed message is namespaced with the literal string “INDXGAME: Betta Fish Trade wallet login” and contains the wallet public key plus a fresh server nonce, defeating both replay and cross-protocol attacks.
2. ² See e.g. Axie Infinity's smooth-love-potion (SLP) collapse in 2022, in which unbounded mint rates produced terminal hyperinflation. Betta Fish Trade's bounded C_match is the explicit anti-pattern.