Proof of reserves
How deposits are held, how the books are checked and what happens if they ever do not match.
Playing happens on the site, so your balance is a number in the game's database. What backs that number is CONVOY held in a vault contract on Robinhood Chain. This page explains how the two are tied together, what is checked and what you are still trusting.
What is held where
- The vault holds every deposit, in one contract. It pays out only against a voucher the backend signs, only to the account's own wallet, and only inside its own limits.
- The ledger is a double-entry book in the database. Every movement of CONVOY, a purchase, a claim, a fee, a withdrawal, is a set of entries that add up to zero. Entries are only ever added: nothing is edited or deleted, and a correction is a new entry that reverses the old one.
The check
About once a minute the game reads the vault's balance from the chain and compares it with everything it owes: the player balances, the live share pool, the season pot, the burned amount, the treasury and the withdrawals on their way. The two must match. The reserves page shows both sides, the result of the last check, the block it was made at, and whether every balance matches its entries.
| If | Then |
|---|---|
| The vault holds less than the game owes | Withdrawals stop on their own until the difference is understood |
| The last check failed or is old | No new voucher is signed. Vouchers only come after a recent, successful check |
| Something looks wrong | A guardian can pause the vault in a single transaction |
The vault's own cap
If the backend itself were ever taken over, the vault would still hold the line. It has its own cap on what leaves in a day, across all players, in the contract. Below it, one account withdraws up to 1,000,000 CONVOY every 2 hours.
- The key that signs vouchers is not the key that owns the vault. It can sign vouchers and nothing else; it cannot move funds.
- Changing the signer or the guardian, or loosening a limit, waits a set delay first. During it, the guardian can pause and cancel the change. Tightening a limit takes effect at once.
- A voucher is for one account, one amount and one nonce, with a deadline, so it cannot be used twice or by someone else.
- The owner cannot withdraw the players' CONVOY. The treasury's share leaves through the same capped voucher path.
What you are trusting
Be clear about what this is. It is not on-chain custody of each player's balance. Your balance, the pool and the shift results live in the game's database, and you trust the game to keep it right. What the design adds is that the books can be checked against the chain by anyone, that withdrawals stop when they do not match, and that the vault limits how much can leave even if something goes wrong.