Built a skill-based game on Solana — Anchor pool + Privy session signers + server-authoritative settlement. Looking for an architecture review.
Solo dev, 6 weeks in. Built a slither.io-style multiplayer game where players buy into a room and cash out winnings in SOL. Devnet for now, mainnet once it's solid. Wanted to get the architecture in front of people who've actually shipped on-chain because there are a few decisions I'm not sure about.
The on-chain flow:
- Player joins a room → buy-in escrowed in an Anchor program (one program holds the pool + settlement logic)
- Game runs server-authoritative (Rust, 60Hz tick) — the server is the only source of truth for position, score, kills
- On cashout, the server signs a settlement instruction; the program pays out the player's share minus a flat house fee
- Privy handles auth + embedded wallets (email/Google sign-in, no seed phrase). Session signers let players act without popping a wallet modal mid-game — this is the part I'm happiest with
- Treasury is split hot/warm/cold; hot wallet only ever holds float for in-flight settlements
- All balance mutations are idempotent + guarded by Postgres advisory locks so a flaky network can't double-credit or double-charge
Where I'd genuinely value feedback:
- Single program vs. split. Right now one Anchor program holds the pool, settlement, and fee logic. Is there a real benefit to splitting into separate programs (pool / settlement / fee distribution)? Upgrade authority and blast radius are my concerns.
- The settlement trust boundary. Game state is server-authoritative, but the settlement instruction the server signs is what hits chain. If the server key leaks, an attacker drains the pool. How are people hardening this? Multisig on settlement? Threshold sigs? A challenge window?
- Session signers in practice. Using Privy session signers for gasless play. Anyone hit footguns with session key rotation / revocation at scale?
- Treasury sweep cadence. Hot→cold sweep is on a timer right now. Event-driven (sweep when hot balance crosses a threshold) feels better but adds complexity. What's the standard here?
Transparency: devnet only, no token, no presale, no NFT mint. The game token is SOL. EU-based operator, working the licensing side before mainnet (iGaming is real, not pretending otherwise).
Live devnet demo + a sample cashout tx in the first comment. Anchor source isn't public yet but happy to walk through any specific part of the design.