Social deduction at a round table: vote out the werewolves before they pick off the village - with nobody able to see who voted for whom.

Under the hood​

The game. Werewolf is N-player social deduction with day/night phases, secret roles, and elimination votes. The client renders a 3D round table with player avatars in Three.js.

Chains. Werewolf splits across two chains: Arbitrum hosts the lobby (createGame / joinGame on a PaimaL2Contract), while the secret voting runs on Midnight. The EVM side is swappable; Midnight is where the privacy guarantees come from.

Running on EffectStream. The EffectStream state machine tracks the EVM lobby and the on-chain round state, and computes the leaderboard. Votes are proved client-side in a WebAssembly worker and submitted through the batcher. A trusted-but-verifiable host node drives the round loop - it provides role witnesses and resolves each phase by decrypting votes - but every step is committed on-chain, so it can't lie: the whole game is auditable at the end.

Leaderboard. Players earn points tracked into the leaderboard endpoint (the Standings panel). No achievements.

The Compact contract​

Source: packages/shared/contracts/midnight/contract-werewolf/src/Werewolf.compact

The headline is secret voting: each vote enters the contract already encrypted, only the host can decrypt it, yet the contract still enforces who may vote (a Merkle proof against the alive set) and that nobody votes twice (a per-round nullifier). Roles are committed up front and revealed only at the end, so the trusted host stays honest by construction.

Admin secret commitment​

The host's authority is a hash commitment, not a wallet pubkey. At game creation the admin's secret is committed as adminSecretCommitment; every admin-only circuit pulls the secret back through the wit_getAdminSecret witness and asserts the recomputed commitment matches. Same idea as Go Fish's owner check, scoped per game via the witness signature (gameId).

export witness wit_getAdminSecret(gameId: Uint<32>): Bytes<32>;

export circuit adminPunishPlayer(
    _gameId: Uint<32>,
    _playerIdx: Uint<32>,
): [] {
    const gameId = disclose(_gameId);
    const playerIdx = disclose(_playerIdx);
    const state = games.lookup(gameId);

    const adminSecret = wit_getAdminSecret(gameId);
    assert(
        Crypto_computeAdminSecretCommitment(adminSecret) == state.adminSecretCommitment,
        "Only Admin can punish",
    );

    const pk = PlayerKey { gameId: gameId, playerIdx: playerIdx };
    if (players.member(pk) && players.lookup(pk).isAlive) {
        const current = players.lookup(pk);
        players.insert(pk, PlayerState { ...current, isAlive: false });
        games.insert(gameId, GameState {
            ...state,
            aliveCount: (state.aliveCount - 1) as Uint<32>,
        });
    }
}

Secret voting (encrypted vote + alive proof + nullifier)​

Every day-phase vote enters the contract as an already-encrypted ciphertext built off-chain in the player's witness (wit_getActionData). The contract never learns what was voted - only the host's key decrypts it later. But the contract still enforces two things: (1) the voter is in the current alive set, proven by a Merkle path against aliveTreeRoot without revealing which player they are, and (2) they haven't already voted this round, via a per-round nullifier inserted into a public Set. The ciphertext lands in roundVotes keyed by the nullifier. The result is a verifiable secret ballot.

// Witness implemented by the player off-chain. ActionData wraps an encrypted
// vote (only the host's key decrypts it), a Merkle path proving the player is
// in the alive set, and the leaf secret used to nullify.
export witness wit_getActionData(gameId: Uint<32>, round: Uint<32>): ActionData;

export ledger voteNullifiers: Set<Bytes<32>>;
export ledger roundVotes: Map<VoteKey, Bytes<3>>;

export circuit voteDay(_gameId: Uint<32>): Bytes<32> {
    const gameId = disclose(_gameId);
    const state = games.lookup(gameId);
    assert(state.phase == Phase.Day, "Not Day phase");

    const actionData = wit_getActionData(gameId, state.round);
    const encryptedVote = disclose(actionData.encryptedAction);
    const merklePath = actionData.merklePath;
    const leafSecret = actionData.leafSecret;

    // (1) Prove the voter is alive, anonymously
    const leaf = Crypto_hash(leafSecret);
    assert(
        Crypto_verifyMerkleProof(state.aliveTreeRoot, leaf, merklePath),
        "Invalid Merkle Proof",
    );

    // (2) One vote per voter per round - nullifier blocks the second
    const nullifier = Crypto_computeNullifierDay(gameId, state.round, leafSecret);
    const publicNullifier = disclose(nullifier);
    assert(!voteNullifiers.member(publicNullifier), "Double voting detected");
    voteNullifiers.insert(publicNullifier);

    // Store the ciphertext for the host to decrypt; the contract never sees the vote
    roundVotes.insert(
        VoteKey { gameId, phase: Phase.Day, round: state.round, nullifier: publicNullifier },
        encryptedVote,
    );
    return publicNullifier;
}

Post-game fairness via master secret reveal​

Role assignments are committed to public state at game creation but stay encrypted until the game ends. When the host reveals the master secret, anyone can recompute the salt for each playerIdx and verify the stored roleCommitment matches the claimed role. The host can't retroactively re-assign roles - the commitments were locked in at createGame time.

export circuit verifyFairness(
    _gameId: Uint<32>,
    _masterSecret: Bytes<32>,
    _playerIdx: Uint<32>,
    _assignedRole: Uint<8>,
): Boolean {
    const gameId = disclose(_gameId);
    const masterSecret = disclose(_masterSecret);
    const playerIdx = disclose(_playerIdx);
    const assignedRole = disclose(_assignedRole);

    const state = games.lookup(gameId);

    // Step 1: the revealed master secret must hash to the public commitment
    const calculatedCommit = Crypto_hash(masterSecret);
    if (calculatedCommit != state.masterSecretCommitment) return false;

    // Step 2: re-derive this player's salt from the master secret
    const saltSeed = std_persistentHash<[Bytes<32>, Bytes<32>, Uint<32>]>(
        [masterSecret, pad(32, "salt"), playerIdx],
    );

    // Step 3: re-derive the role commitment and compare to the stored one
    const pk = PlayerKey { gameId: gameId, playerIdx: playerIdx };
    if (!players.member(pk)) return false;
    const roleCommitment = players.lookup(pk).roleCommitment;
    const derivedCommit = Crypto_commitRole(assignedRole, saltSeed);
    return derivedCommit == roleCommitment;
}

The classic card game, played honestly between two strangers - no trusted dealer, thanks to mental poker.

Under the hood​

The game. Go Fish is a 2-player card game: ask your opponent for ranks, draw from the pond, and collect books of four. The client is built in Three.js with Balatro-style post-processing.

Chains. Go Fish splits responsibilities across two chains: Arbitrum hosts the lobby and matchmaking (a PaimaL2Contract emits createdLobby / joinedLobby), while the actual card cryptography - shuffling, dealing, revealing - runs on Midnight. Arbitrum is swappable for any EVM chain; the Midnight side is where the interesting part lives.

Running on EffectStream. The EffectStream state machine watches the EVM lobby events and auto-starts the match when the second player joins, then tracks the Midnight gameplay. Card moves are proved client-side in a WebAssembly worker and submitted through the batcher in gasless mode, so players don't need a funded wallet to play. A 300-second turn timeout (enforced on-chain) keeps a stalled opponent from freezing the game.

Leaderboard. Players are ranked by games won and win-rate on the leaderboard endpoint (the Standings panel). No achievements - the ladder is the progression surface. The contract is also multi-tenant: one deployment hosts many concurrent games, every piece of state keyed by gameId.

The Compact contract​

Source: packages/shared/contracts/midnight/go-fish-contract/src/Deck.compact

Go Fish's headline is a complete mental poker implementation in Compact - the protocol for shuffling and dealing a deck without anyone, including the contract, learning the card order. It isn't Go Fish-specific: any card game can be built on top of it. Cards are points on the Jubjub curve; players collaboratively mask the deck with secret scalars and reveal cards by peeling those scalars back off.

Cards as elliptic curve points​

Every card is a point on the embedded Jubjub curve. A static deck of 21 points (one per card value) is initialized once at deploy time and shared by every game; each per-game shuffle starts from a copy. Storing cards as curve points is what makes the rest of the protocol possible: std_ecMul(point, scalar) lets each player homomorphically mask the deck with their secret without anyone decrypting anything in between.

module Deck {
import CompactStandardLibrary;
import CompactStandardLibrary prefix std_;
import './HashTransient' prefix h_;

// Static mapping shared by every game: value <-> JubjubPoint
export ledger deckCurveToCard:        Map<JubjubPoint, Field>;
export ledger reverseDeckCurveToCard: Map<Uint<32>, JubjubPoint>;
export ledger staticDeckInitialized:  Boolean;

// Per-game deck state: gid -> {cardIndex -> JubjubPoint}
export ledger gameDeck:         Map<Bytes<32>, Map<Uint<32>, JubjubPoint>>;
export ledger gameDeckSize:     Map<Bytes<32>, Uint<64>>;
export ledger gameTopCardIndex: Map<Bytes<32>, Uint<32>>;

// One-time: seed the static deck with 21 curve points
export circuit init_static_deck(): [] {
    if (staticDeckInitialized) { return []; }
    for (const i of 0..21) {
        const cardPoint: JubjubPoint = getPointFromValue(i);
        deckCurveToCard.insert(cardPoint, (i) as Field);
        reverseDeckCurveToCard.insert((i) as Uint<32>, cardPoint);
    }
    staticDeckInitialized = true;
}

Joint shuffle with cheating detection​

Each player calls shuffle_deck. The circuit masks every card with the player's secret scalar via std_ecMul, then asks an off-chain witness (get_sorted_deck_witness) to return the masked cards in shuffled order. To catch a witness that swapped a card out, the circuit computes a coordinate-based grand product over both the original and the sorted lists with an in-circuit challenge gamma; the products must match. If any card was substituted, the product breaks and the shuffle reverts. After the second player shuffles, the deck is fully masked - no single party can decrypt it.

export circuit shuffle_deck(gameId: Bytes<32>, playerIndex: Uint<64>): [] {
    const gid = disclose(gameId);
    const secret = player_secret_key(gid, playerIndex);

    const INDICES_21: Vector<21, Uint<64>> = [
        0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10,
        11, 12, 13, 14, 15, 16, 17, 18, 19, 20,
    ];

    // Apply the player's secret as a scalar to every card point
    const cards = map((idx) => {
        const point = gameDeck.lookup(gid).lookup(disclose(idx) as Uint<32>) as JubjubPoint;
        return std_ecMul(disclose(point), disclose(secret));
    }, INDICES_21);

    // Witness returns the masked deck in shuffled order
    const sorted_cards = get_sorted_deck_witness(cards);

    // Grand-product cheating check over X-coordinates
    const xsum = fold((acc, c) => acc + jubjubPointX(c), 0 as Field, cards);
    const gamma: Field = h_hashField(xsum) as Field;

    const prod_original = fold((acc, c) => acc * (jubjubPointX(c) + gamma), 1 as Field, cards);
    const prod_sorted   = fold((acc, c) => acc * (jubjubPointX(c) + gamma), 1 as Field, sorted_cards);
    assert(prod_original == prod_sorted,
           "Witness failed: Cheating detected (cards modified)");

    // Write the shuffled, masked deck back
    for (const i of 0..21) {
        gameDeck.lookup(gid).insert((i) as Uint<32>, disclose(sorted_cards[i]));
    }
}

Card reveal via partial decryption​

To learn a card, every other player who masked the deck applies the inverse of their secret scalar with std_ecMul(point, invScalar). Once all masks except the asking player's are peeled off, the result is a JubjubPoint back in the static value-to-point map - the asker reads its card value while everyone else still sees only a masked point. The contract verifies the inverse scalar against a stored hash so a player can't submit a wrong inverse to corrupt the reveal.

// player_secret_key & getFieldInverse are private witnesses; only their
// hashes go on-chain.
witness getFieldInverse(x: Field): Field;
witness player_secret_key(gameId: Bytes<32>, player: Field): Field;

export circuit partial_decryption(
    gameId: Bytes<32>,
    point: JubjubPoint,
    playerId: Uint<64>,
): JubjubPoint {
    const gid = disclose(gameId);
    const secret = player_secret_key(gid, disclose(playerId));
    const secret_hash = h_hashField(secret);

    // Verify this secret was used to mask this game's deck
    assert(
        gamePlayersKeysHashes.lookup(gid).member(disclose(secret_hash)),
        "Player secret key unknown in this game",
    );

    // Recompute the multiplicative inverse and verify against the stored hash
    const invScalar = getFieldInverse(disclose(secret));
    const invScalar_hash = h_hashField(invScalar);
    const expected = gamePlayersKeysInverses.lookup(gid).lookup(disclose(secret_hash)) as Bytes<32>;
    assert(invScalar_hash == expected, "Witness failed: Invalid Field inverse");

    // Peel this player's mask off the point
    return std_ecMul(disclose(point), disclose(invScalar));
}

Press your luck cracking safes for loot - bank your score before an alarm wipes the round.

Under the hood​

The game. Safe Solver is a single-player, turn-based press-your-luck puzzle: open safes one at a time, each resolved by seeded RNG, and cash out before you trip an alarm. The client is rendered in Three.js (native WebGL canvas).

Chains. Same split as BlockKart - Arbitrum for the game inputs (a PaimaL2Contract with fee = 0) and Midnight as a minimal anchor. The EVM choice is swappable; EffectStream handles the sync either way.

Running on EffectStream. The state machine's grammar is initLevel / checkSafe / submitScore: each checkSafe turn is resolved server-side with seeded RNG, and submitScore banks the run. Because a round is many small actions, keeping per-turn state on the EVM/backend side - not on Midnight - is what keeps it responsive.

Leaderboard & achievements. Banked scores are ranked on the /metrics/leaderboard endpoint, and Safe Solver awards achievements shown in the Honors panel.

The Compact contract​

Source: packages/shared/contracts/midnight-contracts/contract-midnight-data/src/midnight-data.compact

Safe Solver uses the exact same minimal Midnight anchor as BlockKart - byte for byte. It's worth seeing the same architectural choice arrive from a different game's constraints.

Same anchor pattern, different reason​

BlockKart needed off-chain speed for racing; Safe Solver needs it for volume - dozens of small actions per round would be prohibitively expensive to prove on Midnight directly. Pushing the per-click state machine onto the EVM side and using Compact only as an anchor is the same design choice for a different reason. When your contract gets this short, ask whether you actually need the rest of Compact's expressiveness or whether the chain is just your notary.

pragma language_version >= 0.18.0;

import CompactStandardLibrary;

constructor() {
}

export ledger payload: Opaque<"string">;

export circuit storeValue(_payload: Opaque<"string">): [] {
    payload = disclose(_payload);
}

A fast-paced racing simulator where you tune a kart, race for the top spot, and climb an on-chain leaderboard.

Under the hood​

The game. BlockKart is a single-player score-attack racer: you submit a car build plus item loadout, and a deterministic race runs against three AI bots. The client renders the race in Three.js (native WebGL canvas) with a CRT-style post-processing pass.

Chains. BlockKart pairs Arbitrum with Midnight. Game inputs go to an Arbitrum PaimaL2Contract (deployed with fee = 0); the deterministic race simulation runs in the EffectStream node; and Midnight holds a tiny anchor contract. Arbitrum is the chosen EVM today, but the EVM layer is standard PaimaL2Contract - point it at any EVM chain and the rest is unchanged.

Running on EffectStream. The EffectStream state machine ingests the EVM PaimaGameInteraction events: a play input records the race entry and schedules an executeRace ~10 blocks later, which replays the seeded simulation, records the result, and awards achievements. The batcher has both an EVM adapter and a Midnight adapter; the Midnight side writes the anchor.

Leaderboard & achievements. Results land in Postgres and are ranked by wins on the /metrics/leaderboard endpoint. BlockKart defines win, loss, and per-surface (dirt/ice/asphalt) achievements, shown in the Honors panel.

The Compact contract​

Source: packages/shared/contracts/midnight-contracts/contract-midnight-data/src/midnight-data.compact

Here's the teaching moment: the Midnight contract is intentionally tiny. All of the racing logic lives on Arbitrum and in the EffectStream node; Midnight is just an immutable anchor. Not every Compact contract should model the whole game.

The "anchor only" pattern​

The entire contract is 11 lines: a single ledger payload: Opaque<"string"> plus a storeValue circuit that discloses and writes it. No enums, no maps, no witnesses, no commit-reveal. The EffectStream node calls storeValue to notarize game-event data on Midnight. Reach for this pattern when you need tamper-evident anchoring but not zero-knowledge - the cheaper the on-chain piece, the cheaper every update.

pragma language_version >= 0.18.0;

import CompactStandardLibrary;

constructor() {
}

export ledger payload: Opaque<"string">;

export circuit storeValue(_payload: Opaque<"string">): [] {
    payload = disclose(_payload);
}

Battle through dungeons with a deck of tradeable characters in a time-gated roguelike.

Under the hood​

The game. Dust to Dust is a single-player roguelike deckbuilder: register, send characters on timed quests, then fight boss battles with the abilities you've collected and upgraded. The client is built on Phaser 3, with a combat scene driven by the contract's resolved state.

Chains. Like Kachina, Dust to Dust is Midnight-only. Quests, abilities, RNG, and progression all live in one Compact contract - no second chain to settle to. The EffectStream foundation keeps that an open choice rather than a hard-coded one.

Running on EffectStream. An EffectStream state machine mirrors the contract ledger (players, abilities, active quests and battles) into Postgres, surfaced to the client through /game/* REST endpoints. Quest and battle transactions are proved client-side in a WebAssembly worker and submitted through the batcher, so moves are gasless for players.

Leaderboard & achievements. Players are ranked by quest points on the /metrics/leaderboard endpoint. Dust to Dust also ships 100+ achievements - spirit-collection, quest milestones, battle feats, smithing - tracked off-chain by the state machine and shown in the Honors panel.

The Compact contract​

Source: backend/packages/midnight/contract-game2/src/game2.compact

The Compact contract is the loot vault and rules engine. Two things make it a good teacher: quests are anchored to real wall-clock time (no client-side speed-running), and the gameplay math is written as circuit-friendly algebra instead of branches, because Compact circuits don't have loops. The contract is actually generated from a template.compact so the combat paths can be unrolled.

Time-anchored quests via blockTimeGte / blockTimeLte​

A quest is started with a claimed start_time that must lie inside a tight 120-second window around chain time. Combined with a level-gating assert against player_boss_progress, this stops clients from speed-running the curve - the quest's duration is enforced by the chain, not the client's clock.

export circuit start_new_quest(
    loadout: PlayerLoadout,
    level: Level,
    start_time: Uint<64>,
): Field {
    verify_loadout(disclose(loadout));

    // Anchor "now" to chain time, not the client's clock
    assert(blockTimeGte(disclose(start_time)),
           "start_time is in the future");
    assert(blockTimeLte((disclose(start_time) + 120) as Uint<64>),
           "start_time is too far in the past");

    // Higher levels require proof of the previous boss completion
    if (disclose(level.difficulty) > 1) {
        const player_id = derive_player_pub_key(disclose(player_secret_key()));
        const prevLevel = disclose(level.difficulty) - 1;
        assert(
            player_boss_progress.lookup(player_id).member(disclose(level.biome)) &&
            player_boss_progress.lookup(player_id).lookup(disclose(level.biome)).member(prevLevel) &&
            player_boss_progress.lookup(player_id).lookup(disclose(level.biome)).lookup(prevLevel),
            "Must complete previous level boss to access this level",
        );
    }

    // [build and insert QuestConfig omitted for brevity]
    return derive_quest_id(quest);
}

Algebra over branches (smaller, faster circuits)​

Compact circuits have no loops and every branch costs constraints, so Dust to Dust writes its gameplay math as pure arithmetic: predicates are cast to Uint<1> (0 or 1) and multiplied into the expression, so a false condition zeroes its contribution out without an if. The score computation below collapses an entire decision tree into one chained multiplication. (This is also why the contract is code-generated from a template - the per-enemy combat paths get unrolled into flat algebra.)

// Ranks how "good" an ability is. Pure circuit - no branches, just math.
export pure circuit ability_score(ability: Ability): Uint<32> {
    return ((
        3 * effect_score(ability.effect)
        + effect_score(ability.on_energy[0])
        + effect_score(ability.on_energy[1])
        + effect_score(ability.on_energy[2])
    ) * (2 + (ability.generate_color.is_some as Uint<1>))) as Uint<32>;
}

pure circuit effect_score(effect: Maybe<Effect>): Uint<32> {
    const aoe = (1 + (effect.value.is_aoe as Uint<1>));

    // Attacks score double a non-attack of equal amount.
    const attack_compensate = (1 + ((
        effect.value.effect_type == EFFECT_TYPE.attack_phys ||
        effect.value.effect_type == EFFECT_TYPE.attack_ice  ||
        effect.value.effect_type == EFFECT_TYPE.attack_fire
    ) as Uint<1>));

    // `effect.is_some as Uint<1>` zeros the whole product out when the
    // optional is empty - no `if (effect.is_some) { ... } else { 0 }` branch.
    return ((effect.is_some as Uint<1>)
            * (effect.value.amount * aoe * attack_compensate)) as Uint<32>;
}

Deterministic per-player RNG via persistentHash​

Each player keeps a single rng: Bytes<32> cell in their Player ledger entry. Every time a circuit needs randomness, get_player_rng reads the current value, advances it via persistentHash<Bytes<32>>(old_rng), and writes the new value back. persistentHash is the persistent (SHA-256-based) hash from the standard library - deterministic enough to replay and audit, but only the player can predict the next value.

// On registration, seed the RNG from a public hash of (player_id, players.size())
export circuit register_new_player(): [] {
    const player_id = derive_player_pub_key(disclose(player_secret_key()));
    const initial_rng = persistentHash<Field>(player_id + players.size());
    players.insert(player_id, Player { 0, initial_rng });
    // [insert starting abilities, etc.]
}

// Every read advances the RNG via persistentHash and writes back.
circuit get_player_rng(): Bytes<32> {
    const player_id = derive_player_pub_key(disclose(player_secret_key()));
    const old_player = players.lookup(player_id);
    const new_rng = persistentHash<Bytes<32>>(old_player.rng);
    players.insert(player_id, Player { old_player.gold, new_rng });
    return old_player.rng;
}

Build a team of gladiators and fight 3v3, head-to-head, in a tactical browser battleground.

Under the hood​

The game. Kachina is a turn-based PvP arena: you draft three heroes, equip them, pick a stance each round, and trade blows until one side falls. The client is built on Phaser 3, with a thin TypeScript API layer bridging the game scenes and the on-chain contract.

Chains. Kachina runs entirely on Midnight - there's no second chain. The lobby, matchmaking, every move, and the win/loss result all live in one Compact contract. Because it's built on EffectStream, swapping or adding a settlement chain later is a config change, not a rewrite.

Running on EffectStream. An EffectStream state machine subscribes to the Midnight indexer, reads the contract's public ledger each block, and mirrors it into Postgres so the frontend can poll game state over REST. Player moves never touch a wallet pop-up for gas: the move is handed to a batcher that generates the ZK proof, balances the transaction with dust, and submits it - so players pay zero fees. Proving happens client-side in a WebAssembly Web Worker, so nobody installs a proof server.

Leaderboard. Wins are tallied from finalized matches into a ranked leaderboard exposed at a /metrics/leaderboard endpoint (the Standings panel on the right). Kachina has no achievements - the ladder is the whole progression story.

The Compact contract​

Source: backend/packages/midnight/contract-pvp/src/pvp.compact

The Compact contract is the referee. It runs the match as a state machine, anchors every action to a witness-derived player secret, gates moves on block time, and - crucially - locks moves behind a commit-reveal hash so neither player can react to what the other hasn't shown yet.

Commit-reveal via transientHash​

P1's move stays in private witnesses; only transientHash<MoveHasher>(secret, commands, stances, nonce) is written to public state. P2 then commits in the clear, and P1 reveals - the contract recomputes the same hash from the now-disclosed values and rejects the reveal unless it matches. transientHash is the circuit-efficient hash from the Compact standard library; the nonce is what makes two identical move sequences produce different commitments.

// In p1_commit_commands - P1's move is committed as a hash:
p1_commit.insert(match_id, transientHash<MoveHasher>(MoveHasher {
    disclose(player_secret_key()),
    disclose(player_commands()),
    disclose(player_stances()),
    disclose(nonce),
}));
commit_nonce.insert(match_id, disclose(nonce));
game_state.insert(match_id, GAME_STATE.p2_commit_reveal);

// In p1_reveal_commands - the reveal must recompute the same hash:
assert(transientHash<MoveHasher>(MoveHasher {
    disclose(player_secret_key()),
    disclose(player_commands()),
    disclose(player_stances()),
    commit_nonce.lookup(match_id),
}) == p1_commit.lookup(match_id), "Commit doesn't match");

Witness-derived player identity​

Identity in Kachina is never a wallet pubkey. It's transientCommit(player_secret_key(), salt) - a commitment the contract can verify but the network can't unwind. Every authorized action calls derive_public_key against the caller's witness and asserts equality with the stored value; an attacker who learns the on-chain commitment still needs the secret to produce a matching one.

witness player_secret_key(): Bytes<32>;

export pure circuit derive_public_key(sk: Bytes<32>): Field {
    return transientCommit<Bytes<32>>(disclose(sk), 123456789);
}

// On every authorized action:
assert(
    p1_public_key.lookup(match_id) == derive_public_key(player_secret_key()),
    "Not authorized as P1",
);

Block-time gating + turn timeout​

Every action carries a claimed now parameter and asserts it lies inside a tight window around the actual chain time using blockTimeGte / blockTimeLte. The same primitives power claim_timeout_win: if the opponent has been silent for longer than TURN_TIMEOUT, the active player can prove the wait against chain time and end the match.

// 5-minute per-turn timeout, in seconds (blockTimeGte uses secondsSinceEpoch)
ledger TURN_TIMEOUT: Uint<64>;
// 2-block grace for clock drift between prover and chain
ledger BLOCK_TIME: Uint<64>;

// On every action - "now" must fall inside the chain-time window:
assert(blockTimeGte(disclose(now - BLOCK_TIME)),
       "Claimed timestamp is in the future");
assert(blockTimeLte(disclose((now + TIMESTAMP_MAX_AGE) as Uint<64>)),
       "Timestamp is too old");

// claim_timeout_win - end the match if the opponent times out:
export circuit claim_timeout_win(): [] {
    const match_id = disclose(current_match_id());
    const last_move_at_timestamp = last_move_at.lookup(match_id) as Uint<64>;
    // [state/auth checks omitted for brevity]
    assert(
        blockTimeGte(disclose((last_move_at_timestamp + TURN_TIMEOUT) as Uint<64>)),
        "Opponent has not timed out yet",
    );
    // ... assigns the win to whichever player is the active one
}