Trust model

Written for someone who does not want to be cheated and does not take marketing copy at face value.

What you can check yourself

The shuffle

Every hand publishes the raw VRF output, every player's salt, each player's prior commitment to that salt, and the final seed. The verify button on any finished hand recomputes the deck from scratch in your browser and checks all of it. If a deck were rigged, that check fails.

Why the deck cannot be steered:

1. Every player commits to a hash of their salt before anyone reveals anything.
2. Everyone reveals. The commitments bind them, so nobody can pick a salt after seeing another.
3. Only then is VRF drawn, with a seed derived from the salts, so nobody can re-request until they like the answer.
4. The shuffle seed is the VRF output XOR every salt.

Biasing it requires the VRF oracle and every seated player to collude. One honest player is enough to keep it fair.

Chip conservation

Chips only move between a player's balance and a seat stack on the base layer, while the table is undelegated. During a hand the rollup can move chips between seats but cannot change the table total, mint a chip, or reach anyone's balance. Solana account ownership enforces this.

The rules

Hand evaluation, betting and side pots live in a separate crate with no Solana dependencies, covered by property tests asserting chips are conserved across any legal sequence of actions.

What you are trusting

Intel TDX

Hole cards are unreadable because the TEE validator refuses to serve them. That rests on Intel's hardware isolation. A TDX break, a side channel, or a flaw in the enclave firmware would expose cards. TEEs have had real breaks. This is a meaningful assumption, not a formality.

MagicBlock as validator operator

If the enclave is compromised, or the operator can extract memory from it, they see every hole card at every table, live, and the deck order before cards are dealt. That is total information. Nothing on chain would look wrong, because the cards would still match the published seed. Shuffle verification does not detect this.

Attestation proves hardware, not code

The app verifies a genuine Intel TDX quote bound to a fresh challenge before trusting the endpoint. It does not compare the enclave's measurements against an expected allowlist, so it does not prove which code is running inside. Read it as "this is real TDX hardware", not "this is the build I expect". Closing that gap needs a measurement allowlist that is not implemented.

What an attacker cannot do

• Another player cannot read your hole cards. Each hole-card account is permissioned to that seat's occupant alone. Measured, not assumed: an authenticated request from a different wallet returns nothing.
• Anyone reading Solana sees no cards. Card accounts are private during play, and the deck and all hole cards are wiped at hand end before anything can carry them back.
• The operator cannot rig the deck without every player colluding.
• A leaked session key can make bad bets at the one table it was scoped to. It cannot cash out, move chips to a balance, or join another table, because those paths need your wallet.

Why not mental poker

Mental poker removes the hardware assumption and is the cryptographically honest answer. We are not using it, so here is why. Every card reveal needs a multi-party decryption round trip, and a player who disconnects mid-hand takes their key share with them, so the hand stalls. Every shipped implementation bolts on timeouts and key escrow, which quietly reintroduces trust anyway.

Making the enclave the dealer turns a disconnect into an ordinary auto-fold. The hand continues without them, like a real table. We swapped a cryptographic assumption for a hardware and operator assumption, and got liveness in return.

Disconnects

Every hand carries a deadline. Once it passes, anyone may call the timeout for the seat that owes an action. It is permissionless on purpose, so the table does not depend on any one client staying online. A player facing no bet is checked down rather than folded, so an unattended player only loses a pot they had already put money into.

Chips and SOL

Chips are bought with SOL and sold back for SOL, at a rate fixed in the program: 1 chip is 1,000 lamports. The SOL sits in a program vault, and chips only exist because someone paid that rate, so every chip is backed the moment it is minted. Buying and selling need your wallet; session keys cannot touch either.

Today this runs on devnet, where SOL is valueless test currency, so the architecture is real money and the stakes are not. Be clear-eyed about what changes if that ever stops being true: the enclave assumptions on this page stop bounding a spoiled game and start bounding custody of funds, the attestation gap above becomes financially material, and real-stakes poker is a licensed, regulated activity in most places. None of that is solved here, and this page will say so for as long as it is true.

Summary