← BACK TO THE GAME

HOW WALLET CONNECTIONS
& CREDIT PAYMENTS WORK

This explains, precisely, what happens when you connect a Solana wallet and buy CREDITS in Retro Invaders — and what's actually verified versus what you're trusting us on. We'd rather over-explain this than have anyone surprised later.

WHAT CREDITS ARE FOR

CREDITS unlock "Online Play" — the mode where your score is submitted to the public leaderboard and counts toward tournament payouts. Free Play never touches your wallet and never requires payment.

STEP 1 — CONNECTING IS A SIGN-IN, NOT A PAYMENT

Clicking "Connect Wallet" triggers Sign-In With Solana — your wallet signs a short message proving you control that address.

This is not a transaction. Nothing is broadcast to the chain, no gas fee, no funds move. Your wallet shows a distinct sign-in prompt, visually different from a payment approval.
The signature is verified server-side (by Supabase, not by this game's own client code), and only then are you issued a real, verified session.
This is what lets your CREDIT balance persist correctly across reloads and devices — tied to a cryptographically verified identity, not just a wallet address string anyone could claim.

STEP 2 — BUYING CREDITS IS A REAL, VISIBLE SOL PAYMENT

Clicking "Insert CREDITS" builds a single transaction containing two visible transfer instructions — your payment is split between two treasury wallets, both public addresses. Your wallet shows you both destinations and the exact amount before you approve anything. You can decline it there, no different from any Solana payment on any site.

STEP 3 — THE PAYMENT IS INDEPENDENTLY VERIFIED SERVER-SIDE

This is the part that matters most for trust. After your payment confirms on-chain, the game does not just credit your balance itself. It hands the transaction's signature to a server-side function that:

Re-fetches the transaction directly from Solana's own RPC — not trusting anything the browser claims.
Confirms it actually succeeded on-chain.
Confirms both treasury wallets actually received their share, by reading the chain's own before/after balance records.
Confirms the total matches the real credit price.
Checks this exact transaction signature has never been used before — every redeemed payment is permanently recorded, so the same payment can never be replayed for a second credit.
Only then adds CREDITS — and only to the account tied to your verified sign-in from Step 1.

If any check fails — payment too low, wrong destination, already used, not confirmed — nothing is credited, and you're shown a real error, not a silent success.

WHERE THE TREASURY ADDRESSES ARE DISCLOSED

Both treasury wallet addresses are public — visible in this game's own source code, and shown directly in your wallet's approval screen before you confirm any payment. You can look up any transaction afterward on a public Solana block explorer using its signature.

WHAT THE GAME CAN AND CANNOT DO

Can:

Ask your wallet to sign a specific, visible message (sign-in) or approve a specific, visible transaction (payment) — you decide each time
Read your public wallet address and a server-verified session identity once you approve

Cannot:

Move any funds without your explicit, per-transaction approval
Access your private keys or seed phrase
Change a transaction's amount or destination after you've reviewed it in your wallet
Credit itself CREDITS without a real, independently-verified on-chain payment behind them
Charge you automatically or repeatedly

THE HONEST RISKS

1. Blockchain transactions are irreversible.

Once approved, there's no undo and no chargeback — a basic property of Solana (and blockchains generally). Only spend what you're comfortable with.

2. CREDITS have no cash value and aren't refundable or transferable.

Treat the price like a quarter in an arcade cabinet, not a financial asset.

3. General wallet-security risks apply, same as any site.

Phishing sites impersonating this one, malicious browser extensions, or approving something you didn't actually read — always verify the URL, and always read what your wallet is asking you to approve.

4. This is a small, independently-built game, not an audited financial product.

The verification logic is real and running in production, built on standard tools (Solana's own RPC, Supabase), but there's been no formal third-party security audit. The payment-verification logic is server-side code we control, not a public smart contract you can independently audit yourself. We do, however, provide a Solscan receipt for every CREDIT purchase, so you can independently verify each transaction on-chain rather than taking our word for it.