jwinterm 3e6e3b858b security: fix underpayment exploit and make provably-fair real ...

Phase 0.1 — Underpayment confirmation bug (CRITICAL):
Payment confirmation gated on `status.confirmed`, which checkPaymentStatus
sets for ANY incoming tx regardless of amount, so sending a single atomic
unit granted a full game/credits. Now gate on `status.complete` (received
>= expected). Underpayers are warned once and the payment stays pending so
a top-up can complete it. Persist `received_amount` for single-game and
credits confirmations for reconciliation. Adds an underpayment regression
test.

Phase 0.2 — Provably-fair was decorative (CRITICAL):
The committed seed had zero effect on the dungeon (created seededRNG was
unused; generation used Math.random + a globally-seeded ROT.RNG). Thread a
per-game seeded RNG derived from the committed seed through dungeon
generation (reseed the Digger via seedToInt + replace all Math.random) and
monster movement (seededShuffle). Add DungeonGenerator.regenerateFromSeed
and layoutFingerprint; /api/verify now regenerates the dungeon from the
seed and returns a fingerprint a player can independently reproduce. Adds a
determinism test suite.

Full suite: 11 suites / 113 tests passing.

Plan and progress tracked in docs/REMEDIATION_PLAN.md.

2026-05-31 09:14:21 -04:00

..

DEPLOY.md

feat: initial batch payout logic and output splitting script added

2026-02-18 07:30:46 -05:00

INTEGRATION.md

fix stale smirk and amount bug

2026-03-01 13:56:35 -05:00

LOGS_AND_BACKUP.md

feat: admin dashboard, alert service, and docs reorganization

2026-01-31 20:21:28 -05:00

REMEDIATION_PLAN.md

security: fix underpayment exploit and make provably-fair real

2026-05-31 09:14:21 -04:00

TODO.md

add smirk payments and leaderboard and diff tuning

2026-02-20 13:54:36 -05:00