Nothing hidden.

How the money works

1. Same stake, one vault

   Both players put the same amount of PUP into a vault that only the PUP Arena program controls. There is one vault per match.

   Program spec: 01 §3

2. Winner takes the whole pot

   The winner receives everything in the vault. On a draw each player gets their own stake back, and any PUP that someone else sent to the vault before the result goes to the creator.

   Program spec: INV-02, 01 §4 settle

3. Only to the two players

   PUP leaves a vault only to the PUP accounts of that match's two players. No key, including ours, can send it anywhere else under this program. The program can be upgraded only by the admin key, and every upgrade is public at least 72 hours before it takes effect (see "Changes are public first" below).

   Program spec: INV-01, INV-03, INV-12

4. No fee

   PUP Arena takes nothing from any match. You pay Solana's network fee for your own transactions.

   Program spec: INV-08

5. The creator's deposit comes back

   The creator pays Solana's rent for the match and vault accounts; the stake sheet shows the live amount before you sign. It goes back to the creator when the accounts close. If the creator's wallet can't take it back at the last payment (it was passed read-only or is a program), both accounts stay open with the rent in them until a later claim closes them.

   Program spec: 01 §3, payout.rs close_or_park

Every rule the program enforces

1. Open a table (create_match)

   Needs the creator's signature and the eligibility gate's. Refused while new matches are paused or an incident is on. The stake must be between the minimum and maximum below, and the join and settle windows within their maximums. The stake moves into the vault, checked by how much the vault's balance went up.

   Program spec: 01 §4 create_match

2. Join a table (join_match)

   Needs the joiner's signature and the eligibility gate's. Only while the table is open, before its join deadline, and not while new matches are paused or an incident is on. You can't join your own table, an invited table takes only the invited wallet, and the stake must equal the table's. Joining stores the commitment to the match's secret seed and starts the settle window.

   Program spec: 01 §4 join_match

3. Take back an open table (cancel_match)

   The creator alone, while nobody has joined. Everything in the vault goes back to the creator.

   Program spec: 01 §4 cancel_match

4. Pay out a result (settle)

   Only the resolver key, only while the match is in play, before its settle deadline and not during an incident. The result is A, B or a draw, and the transaction must name this match's seed commitment and the slot it was joined in, so it can't land on any other match. A win pays the winner everything in the vault; a draw pays each player their stake and any extra to the creator.

   Program spec: 01 §4 settle

5. Fold (concede)

   Either player, while the match is in play. Everything in the vault goes to the other player. Pauses and deadlines don't apply: a player can always give their own match away.

   Program spec: 01 §4 concede

6. Refund (refund)

   Anyone can send it. An open table past its join deadline, or at once during any incident: everything back to the creator. A match in play past its settle deadline, or during an incident: each player gets their stake back and any extra goes to the creator. For a match in play, an incident raised only by the sentinel must first last its refund delay; one the guardian or admin stands behind refunds at once.

   Program spec: 01 §4 refund, INV-04

7. Claim a waiting payout (claim)

   Anyone can send it. If a payout couldn't land because a player's PUP account was closed, the amount stays owed in the vault, and a claim pays it once the account exists again. It works whatever the pause or incident state.

   Program spec: 01 §4 claim, INV-04

8. Config and keys

   Only the admin changes the configuration (limits, keys, the incident refund delay). The admin or guardian can pause new matches, raise or clear an incident, and revoke the gate, resolver or sentinel key. The sentinel can only switch a pause or an incident on. Handing over the admin takes two steps.

   Program spec: 01 §4 set_config, set_paused, set_incident, revoke_key, propose_admin / accept_admin

1. Decided once, paid once

   A match's result is decided at most once, and each player is paid what it owes them at most once. The vault and match account close with the last payment, unless the creator's wallet can't take the rent back then (passed read-only, or a program): then both stay open, marked done, until a later claim closes them.

   Program spec: INV-06, payout.rs close_or_park

2. Paid only to your own PUP account

   A payout goes only to the PUP account at your wallet's standard address. If that account doesn't exist, the amount stays owed to you until a claim pays it; a missing account never turns a win into a refund.

   Program spec: 01 §4 account checks, payouts that can't land

3. Each player paid separately

   One player's closed account never holds up the other player's money: each owed player whose account exists is paid at once, and the rest waits for a claim.

   Program spec: 01 §3 payouts are per player

4. Extra PUP sent to a vault

   PUP that anyone sends to a vault after the result goes to whichever player is paid last, so the vault ends at zero PUP when the last payment lands. PUP sent to a vault that stayed open after a match was fully paid goes to the joiner on a claim, or to the creator if the joiner can't receive it; if neither can receive it yet, it waits in the vault until one of them can.

   Program spec: INV-02, 01 §3 surplus, payout.rs sweep_done

5. Settle and refund never overlap

   A result can be paid only before the settle deadline and a refund only after it (or during an incident), so the two can never both apply. Incident time since the join extends the settle deadline by up to 24 hours, so a freeze can't turn a finished win into a refund.

   Program spec: 01 §4 settle vs refund

6. During an incident

   While an incident is on, no result can be paid: settling is blocked. Refunds become available instead, for finished matches too, since nobody can tell an honest result from a forged one. An open table can be refunded at once. A match in play can be refunded at once if the guardian or admin raised or backed the incident, or after the refund delay if only the sentinel raised it. If the incident is cleared before a refund is sent, the match settles normally.

   Program spec: 01 §4 incident and finished matches, resolve.rs settle and refund

7. Changes are public first

   Every program upgrade or config change is public at least 72 hours before it takes effect, new matches pause the moment one is proposed, and no settle window is longer than 48 hours, so no match is in play when a change lands.

   Program spec: INV-12

8. Only PUP, only Token-2022

   The program accepts only the PUP mint and the Token-2022 program, fixed when it was built. Deposits from a token account with CPI Guard on are refused before anything moves.

   Program spec: INV-05, 01 §4 CpiGuard

9. No bots in wagered play

   No bot, ghost or house account ever plays a match for PUP.

   Program spec: INV-09