Risks & pre-mortem

The game is not worth another run#

A player extracts once, opens the market and leaves. Perhaps combat felt awkward. Perhaps the equipment was uninteresting, or selling it took more effort than it was worth.

We need to watch new players use the whole game, including the market. Where do they stop? Which weapon do they avoid? Can they explain why they would enter again?

The response is to fix those parts of the game. Giving away more tokens would not tell us whether we had fixed them.

The economy outgrows demand#

Equipment survives death, but players keep finding more of it. Inventories and listings can grow even when hardly anyone wants to buy.

We need to compare item creation with consumption and count distinct buyers. Trading volume alone can hide a small group passing items back and forth.

If supply keeps outpacing demand, we should examine which items are useful and how often they enter the game. Additional item sinks need design work. They should not arrive as a surprise loss of equipment players already own.

There is no guaranteed sale price or liquidity. The launch uses Solana mainnet. Listed and deposited NFTs are held by the game operator; see Wallets & NFTs for custody details.

Token tax can outlast the reward service#

The 1% transfer tax is part of the token. Stonkfun must collect withheld XSCAPE, convert it and distribute the quote asset. Transfers can keep paying tax while that service is delayed or unavailable.

The project vault earns as a holder, not as the owner of every fee. Rewards can be small or zero. Burned entry and fabrication fees do not fund those rewards. We should budget from SOL actually received and disclose interruptions, rather than count expected payouts as money available to spend.

The token's tax cannot be removed by changing a game setting. A successful test transfer does not prove the reward service has accepted a launch or paid its holders.

The project vault creates a different expectation#

A large project holding concentrates both tokens and eligible reward weight. Players may assume the balance is locked, the wallet has multiple signers or spending has limits that do not exist.

Publish the public address, actual purchase and net holdings, signer arrangement, any funded lock and material transfers. Until verified, a project vault is a project-controlled wallet. Keep its signing key separate from the online game operator.

A lock, exchange or contract can change the address that receives rewards. Eligibility must be checked before moving tokens into a custody arrangement. Repeated trades between related wallets generate costs and misleading volume; they do not create outside demand.

Players lose trust in their inventory#

A buyer pays but sees no item. A retry grants the same equipment twice. Or a recovery action changes ownership without explaining why. Any of these can destroy trust faster than a balance problem.

The server records operation IDs, locks conflicting actions and waits for chain confirmation. An NFT purchase transfers payment and the item in one transaction. The hosted devnet game completed entry, extraction, minting, a two-wallet sale, an upgrade and return of the same NFT. Separate tests recovered a lost submission response after reconnect and settled competing buyers without charging both for the item.

A test found that signing after an item sold could leave the buyer stuck as pending. The fix passed a new hosted test: the purchase failed, no purchase tokens moved and the buyer unlocked. A failed transaction can still cost a SOL network fee. Wallet-provider prompts, physical phones and payments using the final mainnet token still need verification.

If an ownership error appears, pause the affected economy actions and preserve the records. Establish what happened onchain before correcting inventory. A successful retry on the usual path is not enough to reopen it.

Mobile feels unfinished#

A phone can load the game yet still be a bad way to play. Two thumbs may trigger conflicting controls. Switching to a wallet may lose the login or leave the player unable to return.

We need actual iPhone and Android sessions, including rotation, switching apps and a dropped connection during a trade. Check touch controls and wallet signing separately, then complete a run and trade on the same device.

A narrow browser screenshot cannot establish that this works. If a required phone journey fails, fix it before the mobile release.

Automation or load overwhelms the alpha#

Bots may follow valid game rules and collect rewards faster than people. Separately, too many players or too much stored history may prevent the server from saving a run or settling a trade.

The server validates deployments and limits request rates. Wallet signups have no fixed account quota. NFT registration is capped at 1,000 assets. These controls reduce some abuse and load; they do not eliminate either.

Economic records use separate storage rows. Hosted storage tests have preserved balances during repeated simultaneous updates, but economic writes still compete for a shared revision. Monitor failed writes and old pending transactions, and test additional load before expanding access. Unusual play deserves investigation, not an automatic claim that someone cheated.

Keep the audience within tested limits while this work is unfinished.

Custody or operations fail#

The operator holds powerful keys. A compromise could affect deposited NFTs, game-item minting or metadata. An outage could leave transactions stuck. A backup might exist but fail to restore the records needed to recover ownership.

The pause switch stops new transaction preparations. It does not revoke transactions already signed or repair a compromised key.

A production database backup has been restored into a separate database and checked against the exported records. That does not prove a live cutover or recovery of a lost signing key. Signing-key backup is handled separately. The game records scheduled recovery results and errors in Cloudflare; external incident notifications are not configured. Mainnet entry is open. No independent security audit has been completed, and uptime is not guaranteed.

The docs get ahead of the product#

Someone reads a planned mechanic as an existing rule, or mistakes devnet tests for evidence that a valuable economy works. The problem may be one sentence on a page that nobody updated.

Review costs, rules and feature status with each release. Keep unfinished work labelled where readers encounter it. If the docs and game disagree about spending or ownership, correct both before asking players to use that action.