Whitepaper

Last updated 30 October 2026

BuzzPot is a lowest-unique-number game on Solana. A room fills with players, everybody secretly picks a number, and whoever picked the lowest number that nobody else picked wins the pot. The rules and the money live in one public program, so no server of ours decides anything. This page describes the program as it is deployed on the date above.

The game

Every room has an entry fee, a number of seats and a range of numbers to pick from. A room with 10 seats lets everyone pick from 1 to 10. It starts the moment the last seat fills. There is no countdown.

Once the room is full, everyone locks in a number in secret. When the numbers come out, the winner is the player with the lowest number that exactly one player picked. If two players both picked 2 and one player picked 5, the 2s are out and the 5 wins. If no number is unique, nobody wins the room.

Winning has a price. Every number costs a fixed amount. In most rooms a number costs 1 USDC, so winning with a 3 costs 3 USDC. You only pay if you win, and you pay at the end. The smallest rooms use smaller steps (0.1 USDC in the 5-player room with a 1 USDC entry, 0.2 USDC in the 10-player room) so the price of winning stays small next to the pot.

A worked example: 10 USDC entry, 10 players, 1 USDC per number, 5% fee.

If no number had been unique, the 95 USDC would have gone to the Grand Pots instead. BuzzPot never puts its own money into a pot. A pot is only ever made of the players' entry fees.

Fair play: commit and reveal

If picks were visible, the last player to act could look at them and choose a winner. So a pick is locked in two steps.

Step one: lock in

Your browser makes a random 32-byte secret (the salt) and posts only a fingerprint of your number and that secret:

The fingerprint hides your number: with a 32-byte salt there is nothing to guess against. It also pins you to it, because you cannot later claim that a different number produces the same fingerprint. Your number and salt stay in your browser until step two.

Your wallet and the room are part of the fingerprint, so it only opens for you, in this room. If another player copies your fingerprint and later tries to reveal your number as their own, the program recomputes it with that player's wallet and it does not match.

Step two: reveal

Your browser sends the number and the salt. The program recomputes the fingerprint and rejects anything that does not match. The game needs no randomness, so there is no random-number service or oracle to trust.

A seat that never locks in forfeits, and its entry fee stays in the pot. Lock-in closes before anyone has to reveal, so a player who waits cannot read the other numbers and then choose. The deadline is enforced by the program, not by the timer on the page.

Where the money goes

Players deposit USDC into one vault. The vault is a token account owned by the program, with no private key behind it. Your balance is a record on the blockchain, and you can withdraw whatever is not in play at any moment.

The rule that keeps it solvent: the vault always holds at least all player balances, plus every pot in play, plus the Grand Pot pools. Anything above that belongs to BuzzPot. Besides a player's own withdrawal, collecting BuzzPot's earnings is the only way USDC can leave the vault.

Grand Pots

There are two Grand Pots, an Hourly one and a 12-Hour one. Rooms where nobody won feed them, and qualified players compete for them.

• Feeding. A room where nobody wins sends its whole pot to the two Grand Pot pools, split 50/50 at the moment.
• Qualifying. Play enough rooms before the reveal: 10 for the Hourly Grand Pot, 50 for the 12-Hour Grand Pot. A room counts when you reveal in it, and the count resets after every Grand Pot reveal.
• Joining. A seat costs 1 USDC plus a small network fee. Joining closes 10 minutes before the reveal. The 1 USDC is BuzzPot's and does not go into the pool.
• Playing. You get 5 minutes to lock in a number, then 5 minutes to reveal it. Numbers run from 1 up to the number of players who joined.
• Winning. The lowest unique number takes the entire pool, and nothing is taken from it. If no number is unique, the pool rolls into the next Grand Pot.
• Timing. A Grand Pot runs for one hour, or twelve hours for the big one, and a new one opens right after each reveal.
• Signing. Every Grand Pot step needs a wallet signature. Instant play does not cover Grand Pots yet.

The rooms

There are 24 room types: six entry fees (1, 5, 10, 50, 100 and 1,000 USDC) in four room sizes. A bigger room means a bigger pot.

The pot is 95% of the entry fees, from 4.75 USDC (5 players at 1 USDC) up to 95,000 USDC (100 players at 1,000 USDC). Any room type can be switched off by the config multisig.

The website asks for your entry fee plus a reserve that stays in your game balance to pay your number if you win. Rooms you cannot afford are greyed out, and the number picker only offers numbers you could pay for. That is a rule of the website, not of the program (see the next section).

Things to know

• Several wallets. One wallet gets one seat per room, but nothing stops one person from using several wallets. Every extra seat costs an entry fee, and there are no ID checks.
• A winner who cannot pay their number. The winner's number is charged at the end, from the winner's game balance. A winner who cannot pay it (for example because they withdrew after locking in) loses the room, and the pot goes to the Grand Pots. The website keeps a reserve for this, but the program itself accepts any number.
• Staying quiet at reveal. A player whose number would tie someone else's can stay quiet at reveal time, which gives the other player a clean win. It only helps two players who work together, and the program cannot stop it, because staying quiet costs nothing extra. The Terms of Use forbid it.

Who can change what

• Players can only touch their own balance and their own rooms.
• The config multisig sets the fee percentage, the Grand Pot split, which rooms exist and what they cost, the timing windows and the Grand Pot settings, and it can collect BuzzPot's earnings up to the tally. It cannot move anything else out of the vault or change a balance, because no instruction does that. The fee can be set anywhere from 0% to 10%, and the program refuses anything above that: entry fees, number prices and time windows have upper limits too. A new fee applies to rooms opened after the change, and a room that is already open keeps the fee it was opened with.
• The upgrade multisig can replace the program's code. This is the strongest power in the whole system, because a changed program can do whatever the new code says.
• Both are multisigs made of hardware wallets, and several of them must approve. Their members, the number of approvals needed and the time lock on the upgrade multisig are public on Squads, at the addresses below. Nobody holds a single key that can act alone.

The moving parts

• The program is written in Rust with Anchor. It holds the rules and the money, and every account is a derived address.
• The keeper is a small bot that does the chores: it opens rooms ahead of time, settles rooms, cancels stuck ones and refunds the players, and settles the Grand Pots. Anyone can do all of that, the keeper just does it quickly. It cannot pick winners, because the program works out the winner every time, and it cannot touch funds.
• The website is static pages on Cloudflare. It reads the blockchain through a small proxy (a Cloudflare Worker in front of an RPC provider) that only answers our own site. Wallets connect directly or through WalletConnect.
• Instant play lets the browser hold a temporary key for 2 hours that can join rooms, lock in and reveal. It cannot withdraw, and it can only spend what you allowed when you turned it on: a limit for one room and a limit in all. Several rooms in a row plays rooms one after another with that key, and the page has to stay open.
• Invite links record on the blockchain which wallet invited which player. They pay nothing today: see Refer & Earn.
• Player money stays in the program. The game keeps no database: everything that matters is on-chain, and if our servers vanished, players could still withdraw straight from the program. (The chat is separate and keeps recent messages.)

How it was tested

• 150 automated tests of the program cover the rules, the edge cases, the money maths, the earnings tally and fee collection, and the lock-in deadline. One check in them is that the vault always holds exactly the player balances plus the Grand Pot pools plus BuzzPot's earnings.
• Full games against a local copy of the blockchain with simulated players: a normal room, ties, a player who never locks in, a late lock-in attempt (refused), a room that never fills (refunded), a Grand Pot from start to finish, and the keeper settling everything alone.
• The program upgrade was rehearsed end to end on a local chain, with the real mainnet program and the same multisig tooling used on mainnet.
• Test games on Solana mainnet with real wallets and real USDC.

Numbers and addresses

These are the settings on the date above. The config multisig can change some of them (the fee, the split, the windows). The program and the blockchain are what count.

If this page and the program ever differ, the program is what counts. Playing can lose money: see the Terms of Use.