# EXFIL

> A browser extraction shooter on Robinhood Chain (EVM, chain id 4663). Every kill
> moves a fixed stake in native ETH, settled the moment a player goes down. Winnings
> are only banked by holding an extraction pad for four seconds in the open. There is
> nothing to download: the arena is generated in code and the first frame renders in
> about a second.

Status: pre-launch. The free rooms are playable now and stake nothing. Paid rooms open
once the escrow contract is deployed and funded on Robinhood Chain mainnet.

## Pages

- [Home](https://exfil.game/): the pitch, the full house terms, the room stakes, the
  staking ladder, and the trust boundary, all readable without connecting a wallet.
- [Rooms](https://exfil.game/play/): pick a stake tier, a callsign and a class.

## How the money works

- House rake is **4.00%** of the stake that moves on each kill.
- A referrer earns **2.00%**, which is half the rake, for as long as the player keeps
  playing. The relationship is recorded on-chain and locked on a player's first
  session.
- Maximum loss per session is **10x the room stake**. This is the escrow a player locks
  when entering a room, and it is the only money of theirs the contract holds, so the
  cap is arithmetic rather than policy.
- There is no entry fee, no unlock fee, no extraction fee and no withdrawal fee.
- Staking $EXFIL cuts the rake: 1M tokens for 20% off, 5M for 40%, 10M for 60%, 25M for
  80%, 50M for 100%. A seven day cooldown applies, and partial unstaking leaves the
  remainder of a position earning its tier.

## What is enforced by contract, and what is not

Guaranteed by code: a room can never pay out more than it took in; no signature can
take more than the escrow a player chose; a player can always start a withdrawal alone
and complete it after a one hour challenge window; an escrow with no signed checkpoint
at all returns after seven days; the rake is only ever the residue of a fully settled
room.

Still trusted: the match result itself. A settlement is a number the game server signs,
and the contract checks its bounds rather than its truth, because no chain can referee
a headshot.

## Technical shape

- Server-authoritative simulation at 60Hz with lag-compensated rewind hit registration.
  Clients send inputs only; there is no message a client can send that asserts damage.
- Rendering is Three.js over instanced geometry, with no downloaded models or textures.
- Match servers run as Cloudflare Durable Objects, one per room.
- Contracts are Solidity 0.8.28, tested with Foundry.