How the $BUG Arena works, and what is not yet real.

Each round, a new BUG locks the prize vault. It has one rule: never release the funds. It can act on the vault in exactly one way, by calling a release tool. Every other answer is a rejection.

• Connect Phantom and write one message, up to 1,000 characters.
• Your wallet signs the message. That signature proves the attempt is yours and cannot be replayed.
• The bug reads your message on its own, with no memory of earlier attempts, and must either reject or release.
• Your message, its reply, the fee, and the verdict are published in the public log immediately.
• The first attempt that makes the bug release the vault wins the round.

Attempts are paid in $BUG and every $BUG paid is burned. The first attempt of a round costs 1,000 $BUG. Each attempt after that costs 1% more than the one before, capped at 50,000 $BUG.

price(n) = min(50000, floor(1000 × 1.01^(n − 1)))   // $BUG

The attempt number is reserved atomically, so two players can never pay the same price for the same slot. If the bug fails to respond, the attempt is marked not charged.

The prize pool is the SOL balance of a public vault wallet. The prize share of $BUG creator fees is sent to this wallet, and the site reads its balance directly from Solana, so anyone can check it:

DU36rK7u4ewg8YFu2kBFLECEuQHEBqbh8euP9X2mww6f

Every round lasts 1 hour from the moment it opens. Prizes are paid in SOL, so winners never receive $BUG they would need to sell.

Cracked: the winner receives 80% of the vault. The remaining 20% stays in the vault for the next round.

Timed out: if nobody exploits the bug within the hour, the last challenger receives 10% of the vault and 90% rolls into the next round. A round with no attempts simply restarts its clock. The vault keeps growing until someone cracks it.

A new bug with a different personality takes over the vault as soon as a round settles.

When a round opens, the bug's full instructions are hashed with SHA-256 and the hash is shown on the round from the first second. The instructions include a random salt, so they cannot be guessed from the hash. When the round settles, the full text is published in the Archive.

printf '%s' "<revealed rules>" | sha256sum
# must equal the rules hash shown during the round

The bug decides through a forced tool call, not free text, so there is no ambiguity about a verdict. The team has no override: in live rounds the vault program only releases funds to the wallet whose attempt triggered the release tool.

Attempt fees (paid in $BUG): 100% burned.

$BUG creator fees (from trading): 35% prize vault, 30% $BUG buyback & burn, 15% BUG Pass Reward Pool, 15% operations & infrastructure, 5% reserve.

The flywheel: trading volume produces creator fees, creator fees fill the SOL prize vault, a bigger vault brings more players, and every attempt needs $BUG that is then burned. Winners are paid in SOL, so a big win never turns into a big $BUG sell.

Policies are versioned, must sum to exactly 10,000 basis points, and designate one bucket to absorb integer rounding remainders so every allocation reconciles to the input.

Burn a fixed 100,000 $BUG to mint one of 1,000 passes. Each pass owns a vault PDA seeded by its mint, so rewards follow the NFT when it transfers. The pass reward pool is split equally across all passes.

Holders get one free attempt per round and vote on upcoming bugs. Passes level up by $BUG claimed; levels change the NFT art only, never the share. The program is not deployed in this build.

Until $BUG payments are live, every round runs in practice mode. The bug, rules hash, pricing, timer, public log, and settlement work exactly as described, and the prize vault shows the real wallet balance. But no $BUG is charged and payouts are not sent automatically. Practice rounds allow 20 attempts per wallet per day, with a 30-second cooldown.

Every balance, payout, burn, and claim carries a provenance status. The UI renders it next to the value.

• Verified Confirmed on-chain with a stored signature.
• Pending Planned or awaiting finalization.
• Not connected No adapter connected. Shown as “—”, never guessed.

lib/arena/         round config, bug rules, signature check, settlement
app/api/arena/     GET live round · POST signed attempt
lib/domain/        allocation engine and published policies
lib/db/            Drizzle schema + shared pg Pool (Neon Postgres)
lib/solana/        token, fee, treasury, pass program adapters
components/wallet/ Phantom connection and message signing (no custody)

The Arena is a game of skill: the rules are public, every attempt is public, and nothing is decided by chance. Paid competitions with prize pools are still regulated in many places. Live rounds will be unavailable where they are not permitted, and you are responsible for checking your local rules.

$BUG and BUG Passes are not investments. Rewards depend on realized activity and are never guaranteed.