Source-available materials for astroid.club.
This repository exists so $ASTROID holders can verify, in source, the two things that matter most:
- The Club only reads your wallet. It never signs, submits, or moves anything for you.
- There is a kill switch on every on-chain side effect. Default off; flipped on slice-by-slice as live-play features ship, with an audit trail.
If you are evaluating whether the Club is a safe place to sign in with your wallet, start here.
- Public preview: https://preview.astroid.club
- Token: $ASTROID on Solana
- Status: in active development; the live arena is in playtest behind the holder gate
The preview surface is the Club exactly as it ships, with on-chain side effects gated off by default. No real-asset transfers occur on this tier.
| Question | Answer | Where to verify |
|---|---|---|
| Can the Club move my tokens? | No. The read-path has no signer. | docs/HOLDER_VERIFICATION.md |
| Can the Club broadcast a transaction on my behalf? | No. The shell uses Privy strictly to sign a short auth nonce. The signature proves wallet ownership; nothing else. | examples/wallet-sign-in.ts |
| What stops a flash-loaned wallet from getting in? | A continuous-hold tracker plus first-observation pre-warming from on-chain transfer history. | docs/HOLDER_VERIFICATION.md |
| Is anything actually moving funds today? | No. The CHAIN_ENABLED flag is the master switch and is currently scoped to read-only ops. |
docs/CHAIN_AUDIT.md |
| What stack is this built on? | Next.js + Three.js shell, Node WS gateway, Solana via Helius RPC, Privy for wallet sign-in. | docs/STACK.md |
| Path | What it is |
|---|---|
docs/HOLDER_VERIFICATION.md |
How the holder gate reads your balance, in plain English |
docs/CHAIN_AUDIT.md |
The kill-switch architecture, ops surface, and verification steps |
docs/STACK.md |
The technologies the Club is built on, and why each was picked |
docs/SECURITY.md |
Vulnerability disclosure policy |
examples/holder-verify.ts |
Minimal, runnable holder-balance read |
examples/wallet-sign-in.ts |
Minimal, runnable nonce-and-sign demo |
Run the examples:
npm install
HELIUS_API_KEY=your_key npm run example:holder -- <wallet-address>
npm run example:sign-inGame-balance tuning (yield curves, raid odds, drill-power formulas, anti-cheat thresholds), the gateway's full message protocol, and deployment secrets are intentionally kept private. Publishing them would help bad actors tune attacks against the live game without giving holders any additional trust signal.
The trust-relevant claims (read-only chain access, kill switch, holder gate) are fully verifiable from what is in this repo.
If you want a deeper audit of the closed components, reach out via X and we can arrange a private review under NDA.
- X: @HeartOfMidgar
- Live preview: https://preview.astroid.club
- Vulnerabilities: see
docs/SECURITY.mdfor the disclosure policy
MIT. Fork it, learn from it, ship something with it. The only ask is that you don't pretend you wrote it.
Part of the Saltaire Protocol ecosystem.