Best-of-both-worlds rebuild of ORE + ZINC mechanics as an EVM protocol. See research/ore-zinc-teardown.md for the verified teardown this design is based on, and docs/MECHANICS.md for the exact game spec.
Everything in ORE/ZINC is portable except:
| Piece | Solana original | EVM answer |
|---|---|---|
| Fast cheap rounds | 400ms slots, sub-cent fees | Robinhood Chain: 100ms blocks, cheap gas ✅ |
| Per-round randomness | Solana slot-hash / on-chain RNG | Pyth Entropy or Chainlink VRF (request→callback). Abstracted behind IRandomness so we can swap. Must verify which is live on Robinhood Chain — Chainlink was integrated day one; Pyth Entropy is on most Arbitrum-stack chains. Fallback: operator commit-reveal beacon (weakest trust, MVP-only). |
| Encrypted tile picks (Arcium) | MPC network, Solana-only | Commit-reveal: picks hidden during the betting window, revealed at settlement. Weaker than Arcium (patterns become public after the round) but kills real-time copy-trading/front-running, which is 90% of the value. v1 ships public picks (ORE-style); stealth commit-reveal is v1.5. |
| SPL token | — | ERC-20, capped supply, game is sole minter ✅ |
| Native asset staked | SOL | ETH (Robinhood Chain gas asset) ✅ |
Trust caveat to design around: Robinhood runs the only sequencer. Randomness must be
request→callback VRF-style (committed after deposits close), never prevrandao/blockhash,
or the sequencer (or a miner-adjacent party) could bias outcomes.
mine/
├── PLAN.md ← this file
├── research/ ← ORE/ZINC teardown (source of truth for mechanics)
├── docs/
│ ├── MECHANICS.md ← exact game spec (params, math, edge cases)
│ └── THEME.md ← branding directions
├── contracts/ ← Foundry (Solidity 0.8.26)
│ ├── src/
│ │ ├── Game.sol ← rounds, deploys, settlement, claims, refining
│ │ ├── MineToken.sol ← ERC-20, 3M cap, game-only minting
│ │ ├── FeeRouter.sol ← fee split: buyback / jackpots / ops
│ │ ├── Staking.sol ← single-sided staking, dual yield (token + ETH)
│ │ ├── interfaces/IRandomness.sol
│ │ └── rand/ ← PythEntropyAdapter / ChainlinkVRFAdapter / MockRandomness
│ ├── script/Deploy.s.sol
│ └── test/
├── apps/
│ ├── web/ ← Next.js 15 + wagmi/viem + RainbowKit (UI via Claude design later)
│ ├── keeper/ ← Node/TS bot: close rounds, request randomness, execute buybacks
│ └── indexer/ ← Ponder: events → Postgres → API for charts/history/leaderboard
└── package.json ← pnpm workspaces
- Contracts: Foundry + OpenZeppelin. All payout math is pull-based accumulators (no unbounded loops at settlement) so a round with 10,000 depositors settles in O(log n).
- Keeper: the only permissioned actor in v1 — closes rounds, triggers randomness requests, runs buyback swaps through the on-chain DEX (Uniswap v3 is deployed on Robinhood Chain). Everything the keeper does is either permissionless-after-timeout or verifiable on-chain.
- Indexer: Ponder (EVM-native, TypeScript). Feeds round history, jackpot pool sizes, leaderboards, streaks, PnL — the web app reads chain state directly for the live round and the indexer for everything historical.
- Web: Next.js. Live 5x5 grid, countdown, pot sizes, jackpot tickers, claim/refine panel, staking page. Visual design to be produced in Claude design once THEME is chosen.
Directly copying the verified winners:
- Fee = 10% of ETH deployed per round (ZINC-style rake on flow, taken at deploy):
- 7% → buyback engine → 90% of bought tokens burned, 10% to stakers (ORE/ZINC flywheel)
- 2% → jackpot pools (funds the four-tier ladder)
- 1% → ops treasury ← this is protocol revenue you keep
- Refining fee (10% of token claims) → redistributed to unclaimed balances (pure retention, we keep none — this is what makes the "99% goes back to players" pitch true and marketable, which per the research is exactly ORE's credibility engine).
At ORE's observed scale (~$46M annualized fees on the 10%-of-winnings rake) a 1% ops slice on flow is meaningful; the real prize is owning supply of the token the buyback engine supports.
- Web: fully static (no SSR, no secrets, no custody) → Cloudflare Pages + custom domain. Next.js static export. All live state read client-side: chain via RPC provider, history via indexer API. Geo-fencing implemented at the CF WAF layer, not in app code.
- Indexer (Ponder) + keeper: one small VPS (or Railway/Fly) + Postgres (managed, e.g. Neon). Keeper is not user-facing and has on-chain permissionless fallbacks — a dead keeper never strands funds. Scale pressure lives in RPC reads + indexer queries, not the site.
- RPC: provider endpoint for Robinhood Chain (confirm availability in P4). The browser talks to the chain directly; our servers are never in the money path.
- P0 — Spec freeze (docs/MECHANICS.md): params, math, edge cases. ← done, review it
- P1 — Contracts MVP: Game + Token + FeeRouter + MockRandomness, full Foundry test suite, invariant tests (pot conservation, cap, fee splits).
- P2 — Keeper + local loop: anvil chain, keeper driving rounds end-to-end, seeded bots.
- P3 — Web MVP: live grid + deploy + claim against local chain. Theme/branding applied.
- P4 — Robinhood Chain testnet (unblocked 2026-07-14 — both former blockers done): ✅ randomness: DrandAdapter verifies drand evmnet beacons on-chain (BN254 pairing, ~318k gas/settle, zero oracle fees; validated against a live beacon in tests; keeper relays via api.drand.sh, permissionless for anyone else). ✅ buyback: FeeRouter swaps via UniswapV2Router02 0x89e5DB8B5aA49aA85AC63f691524311AEB649eba (WETH 0x0Bd7D308f8E1639FAb988df18A8011f41EAcAD73), 90% → Strategic Reserve / 10% → stakers, keeper-supplied minOut. Remaining for testnet: deploy with USE_DRAND=true, seed LP, point web env at chain 4663.
- P5 — Audit + launch: this contract class (holds user funds + RNG + token mint) is a top-tier exploit target — ORE itself was exploited June 2026. Budget a real audit.
- P6 — v1.5: commit-reveal stealth picks, streak multiplier tuning, Stockpile-style burn lottery (only if retention data justifies it — ZINC's is currently paused).
- Legal — flagging once, plainly: this is real-money parimutuel gaming plus a token issuance. In most jurisdictions that combination lands under gambling and/or securities law, and Robinhood Chain sits under a heavily regulated brand that may police its ecosystem. Ship-anyway norms exist in this genre (ORE/ZINC are anonymous teams), but decide deliberately: entity structure, geo-fencing the frontend, and counsel before mainnet.
- Randomness on Robinhood Chain — SOLVED by competitor observation (2026-07-14): SLVR
(slvr.fun, live on this chain since 2026-07-09) uses drand — at betting close the
contract pins a future drand beacon round (wall-clock), unknowable while betting is open
(a bounded "reveal safety buffer" absorbs chain-clock drift); anyone then submits the
beacon, BLS-verified on-chain, to resolve permissionlessly; missed beacons re-pin via
reRequestResolve. Free (no per-request fee at our 1-2k rounds/day), provably fair, proven on this exact chain. Implement a DrandProvider behind IRandomness; their verified source at robinhoodchain.blockscout.com (SlvrGridLottery 0x284Eb4...1c7f) is the reference. Chain facts confirmed: chainId 4663, RPC rpc.mainnet.chain.robinhood.com. - Competitor — SLVR (slvr.fun): custom, professional Foundry/OZ codebase that reimplements ORE's design (their code comments cite ORE's Rust internals). 25 squares, 60s betting + 30s reveal, 10% rake (8% veNFT stakers / 2% jackpot), single 1/625 jackpot, 10% refining fee, 1.12 SLVR/round (incl. 8% team + 4% growth, perma-locked veNFTs), 500k cap, no buyback. Week-1 traction: ~$2.1M wagered, ~$36k/day fees, but only ~94 miners, $272k mcap, $28k liquidity, and fees flat after day 2. Our edge: retention stack (jackpot ladder, streaks, concentration bonus), buyback→Strategic Reserve flywheel, zero premine, real brand. Their ideas worth adopting: per-square bet amounts, bounded owner setters (MIN/MAX consts), bet/reveal window cycle, anti-dust account deposit, ve-bribes (v2). Their trust weaknesses to NOT copy: pause() freezes claims, owner can force-upgrade the jackpot contract.
- Mechanics are imitable, and that cuts both ways: nothing stops us copying ORE/ZINC (game mechanics aren't protectable, and we reimplement from scratch in Solidity — copy zero code, ORE's Rust license is irrelevant to a reimplementation). Nothing stops the next team copying us — moat is theme, execution, cadence of shipping, and the token's liquidity.
- Cold-start: parimutuel games are dead at zero players (you win your own money back minus fee). Mitigations: emissions weighted heavily in week 1, protocol-seeded jackpot pools, possibly protocol liquidity bootstrapping before public rounds.
- Keeper liveness: rounds stall if keeper dies → permissionless
poke()paths + timeout refunds are in the spec.