Handling instructions

DO NOT OPEN is a collection of 10,000 NFTs on Ethereum, built with Zama's encryption. Each token is a cardboard box. When a box is minted, the contract draws a random number for it and keeps that number encrypted. The cat inside, its state, its five traits and its rarity are all worked out from that one number. Who holds each box is encrypted too.

Encrypted here does not mean hidden behind a server or revealed later from a list someone prepared. The number is a ciphertext on-chain from the moment it exists. The contract can still compute with it: compare it, cut a piece out of it, add to it. It does that without ever decrypting it, which is what fully homomorphic encryption is for.

So the game is about what you choose to find out, and what that costs you. Shake a box and you learn one thing about it, privately. Open it and everyone learns everything, for good.

The game has five counters. One rule tells them apart: what is about a box is encrypted, what is about a rat is not. Money crosses between the two at the bureau de change, and the amount shows at the border.

Every box holds one of these. Ten breeds, from the everyday tabby to the glitch that almost never turns up; four states, only one of them fully awake; and a few surprises on top. Spin the turntable and say hello. And then the ones you make yourself with croquettes, from thin to huge, all the way to sick.

The odds under each cat come straight from the game's tables. How a box lands on one of them is the next section.

The first time you connect a wallet, the game hands you a release form, Form DNO-1: the terms of play, eight short clauses. They say plainly what you are walking into. The contracts are experimental software: nobody has audited them, and a bug, an exploit or a hack could lose what you put in, without the creators being liable as far as the law allows. The website is only a window: your boxes, cats and balances live on-chain, so if the site breaks, nothing of yours is lost. Nobody holds your money for you, nothing is refunded, and none of this is an investment.

You initial each clause, one click each, then sign with your wallet. The signature is free and sends no transaction: your wallet shows a readable message naming your address, the version of the terms and a fingerprint of the full English text. The translations are there to read; the English text is what you sign. The signature is kept as a record of your acceptance, by the game's server when it is reachable, and always in your browser. Without a wallet, nothing is asked: you can look around the whole site, and the form only comes up when a wallet that has not signed it connects. You can close it to keep looking around, or switch to another wallet from it; any action you then ask for (a mint, a shake, a feed) brings it back until it is signed.

Each new wallet signs once, and a new version of the terms is signed again before playing on. To read the form again and see your signature, open the menu and choose Terms of play. On the test network nothing is signed: the form waits for mainnet, and a notice says instead what an update of the contracts keeps (your points, your whitelist seat, your X pass).

A box holds a single 64-bit seed. Its bits are cut into seven fields. Sixteen decide whether the cat is alive, asleep, a ghost or quantum. Five bytes are the five traits. The last byte only changes how the cat looks.

Keeping one encrypted number instead of eight keeps a mint cheap. Everything else is worked out from it when a mechanic needs it: under encryption while the box is sealed, in the clear once the box is opened. The app reads a seed exactly the way the contract does, so the cat you see is the cat the chain holds.

The rarity score is a weighted sum: three times the breed roll, the mood roll, twice the accessory roll, the broken thing, the room, plus a bonus for the state. A quantum cat starts 1,000 points ahead. The highest possible score is 3,040.

The owner of each box is encrypted, like its seed. That is not how NFTs usually work: an ordinary NFT says publicly who owns it. Here nothing does. Nobody can see who holds a box, or count anyone's boxes. The collection follows a new standard written for this, the confidential ERC-721.

Sending a box never fails because of who holds it. If you hold it, it moves; if you do not, nothing happens. Either way the sender and the receiver get an encrypted receipt that only they can read, saying whether the box moved, and everyone else sees a transfer that may or may not have happened. You find your own boxes the same way: the app reads the receipts that name you and decrypts them, with one signature per visit. That is what Show my boxes does.

Minting works on the same idea. It is paid in cUSDC only, and your browser encrypts how many boxes you want. You also pick how many token ids to hide that number among, from 1 to 10, and that choice is public. The first ids, up to your quantity, are yours; the others are empty boxes owned by nobody, and from outside the two look the same. More ids hide the quantity better and cost more gas. A mint that would pass the cap, or that your cUSDC balance does not cover, gets nothing and pays nothing.

The number of boxes sold is an encrypted counter, capped at 9,000 under encryption: of the 10,000 boxes, the other 1,000 are kept for the whitelist's gifts, minted free when a seated wallet collects its gift, never sold. Only milestones of the sale are announced: 100, 500, 1,000, 2,500, 5,000, 7,500, 9,000, the last one meaning sold out. The gift boxes count in none of them. Each mint makes public a single yes-or-no answer, whether the next milestone is reached, and anyone can announce it.

Some things stay visible, by design. A mint shows the buyer's address and how many ids it created, which is an upper bound on what they bought. A transfer attempt shows who sent it and to whom, as a maybe. And an action that has to become public (an opening, an alive check, a box put up for a duel, or a duel or an entanglement that goes through) shows that its caller held that box at that moment. An attempt by someone who did not hold it settles as refused and shows nothing about the box. Croquettes add one more: the app only feeds boxes you hold, so a meal, whose event names the feeder, shows a box you hold, even though the contract treats a stranger's meal the same way. Claims do not: the app always claims for whole rows of ten box numbers, yours among others.

This is also why the leaderboard ranks only opened cats, and the players who opened them: an opening publishes its opener, while who holds a sealed box stays hidden.

One of those public facts reaches further. Once an action has shown that an address held a box, the next transfer of that box from that address is certainly real, not a maybe, so the box can be followed to its next holder, and from there onwards. When you give a box away, you can tick "Send 3 decoys with it": three more transfers of the same box to random addresses, which move nothing but look like the real one, sent in a random order with it. Then nobody can tell which one moved the box, or whether any did. Each costs gas. Without decoys, keep a box out of sight by receiving it, or moving it, at a fresh address you never use to prove anything.

Every ciphertext has an access list. For the seed, that list has one entry: the contract. No holder is ever added to it, because an address on the list could ask the key service to decrypt the seed directly and skip the game.

Two consequences are deliberate. A holder who shakes often enough learns all five traits: a shake shows one of five at random, so about eleven cover them. What stays hidden even from the holder is the state, which is worth up to a third of the score, and the affection. And duels leak order: each one publishes which of two boxes scores higher. Putting a box up for a duel also shows that you hold it: that is how the duel shelf only carries boxes someone holds. That is the price of duelling.

Petting adds a hidden amount between 0 and 3 to a hidden counter, and nothing at all if the pet was not paid. So the pets anyone can see on-chain say nothing about the counter, not even how many counted. Past 10, the accessory turns golden when the box is opened, and a cat with no accessory gets a golden bell collar.

Every price is in cUSDC, Zama's confidential USDC: nobody but you can read your balance or follow your payments, and the amount you paid is encrypted like the rest. A cUSDC payment cannot fail on-chain: a short balance just moves 0, and the action then does nothing. A mint gets no boxes, a paid shake reads "not yours", a pet adds nothing, an opening is refused. Paying from plain USDC means shielding the exact price into cUSDC first, in public, and for a mint that amount gives the quantity away. Shielding a round amount ahead of time, at the bureau de change, does not.

Duels have a ranking of their own, in the leaderboard's Duels tab: boxes, not players, by duels won, then by fewest lost. The top three wear a rosette pinned to the front of their box, gold, silver and bronze, as at a cat show. A box can climb the podium and stay sealed: the ranking uses only the winners and losers that every duel already makes public, never who holds the box.

There are two ways out of encryption. A private decryption re-encrypts a value for one person, who must be on its access list. A public decryption publishes a value with signatures from the parties that share the key, and the contract verifies those signatures before it believes anything.

The contract never receives a callback. A reveal is a request on-chain, a decryption off-chain, and a second transaction that carries the proof back. Anyone may send that second transaction. Every request also checks, under encryption, that its caller holds the box; that bit is decrypted with the rest, and a no settles the request as refused, with zeros in place of the box's values.

On this protocol an access grant cannot be revoked. A design that put the holder on the seed's access list could never take the seller off it. This one never puts anyone on, so a sale has nothing to undo on the seed. What changes hands is the encrypted owner, along with what waits in the box: paid-shake earnings and croquettes go with it.

If you buy a sealed box, assume the seller knows its five traits. A few paid shakes before buying level that. And a transfer that names you is only a maybe until you decrypt its receipt: Show my boxes does it for you.

Everything in the game is priced in USDC, a dollar stablecoin, and most of it is paid in cUSDC, its encrypted form: nobody but you can read your balance or follow your payments. Here is every fee, who receives it, and what it pays for.

Why decryptions cost anything: reading something encrypted takes work from Zama's network. The parties that share the decryption key each have to take part, and Zama charges for it, for every value read, from a tenth of a cent to ten cents depending on the plan. Checking the proof that comes with a value your browser encrypts costs five times as much. It charges the collection, not you. Shaking, finding your boxes, reading your own balance, the result of a duel: each one is a decryption. Minting, feeding a cat or sending croquettes: each one encrypts a value.

So every wallet gets 25 free units a day, paid by the collection, and they come back at midnight UTC; a wallet that has not played yet gets 16, enough for a first mint. Reading a value is one unit: a shake uses 2, and finding the boxes from a mint uses one per box number it hid among. Encrypting a value, like a mint's quantity or a meal, is 5. What your browser has read once, it remembers, and it is never counted again. Past the free ones, you spend credits, one per unit, bought at the bureau de change. Their price follows what Zama charges the collection in dollars, not the price of Zama's token, so it does not swing with the market. They are paid in plain USDC on purpose: a balance that falls short cancels the purchase, where a cUSDC payment would quietly move nothing. Making a value public, to open a box, settle a duel or announce a milestone, is 1 unit a value, counted to the wallet that asks first: an opening takes 2 to 5, a duel 1 to post and 5 to settle. Asked again, by anyone, it is free. That way nobody can post duels in a loop at the collection's expense. In the game, the Decryptions meter at the top right counts what is left (free today, plus credits): it blinks when you are running low, turns red at zero, and a click opens the bureau de change to buy more.

The treasury pays what keeps the game running: Zama's fees for every free unit, and the servers that follow the chain so the site stays fast. The rest goes to the project. Nobody can read the cUSDC it receives, the owner included: read after every payment, it would give away each mint's hidden quantity, and so who bought which boxes. The owner withdraws it at most once every 7 days, so it only ever learns weekly sums. An opening's 1 USDC fee waits until the opening settles: it joins the treasury when the box opens, and goes back to the opener if the box's entangled partner opened it first.

The game uses five tokens: ETH for the network's gas, USDC and CROQ, which are plain, and cUSDC and cCROQ, the same money sealed. A plain balance is public, like any ordinary token; a sealed one is encrypted, and only you can read it. To go from one to another, open the menu and choose Bureau de change: say what you hand over and what you want, and it finds the way and shows every cost before you sign. The rate and the number of transactions stay in sight under the form; Details unfolds the route, each fee and what becomes public. It also lists what you hold; sealed balances are decrypted on demand, for you alone, with one signature.

Some exchanges take one transaction: buying USDC with ETH (it can arrive sealed, as cUSDC), shielding USDC into cUSDC or unshielding it back, buying or selling CROQ for USDC, sealing CROQ into cCROQ or unsealing it. Any other pair chains these steps: ETH to cCROQ, for example, is three. Each step is its own transaction, signed one after the other, and in between the money waits in your wallet as plain USDC or CROQ. If a step delivers nothing, because a sealed balance smaller than the amount moves nothing, without a word, the bureau stops and tells you where your money is. ETH can only be handed over, never received.

Buying USDC with ETH costs 0.3% of the ETH, kept by the site. Shielding and unshielding are free. Every step pays the network's gas, like any transaction. A trade on a pool can land at a worse price than quoted if someone trades first: the slippage tolerance, 1% unless you change it (from 0.01% to 50%), is how much worse you accept before the transaction cancels itself, costing only the gas. The bureau also shows the price impact, how much your own trade moves the pool's price, and warns you above 2%.

What becomes public: plain tokens move in the open, so every swap shows its amounts, and so does every crossing between plain and sealed. The amount you shield or seal is public, and so is the amount you unshield or unseal: it is decrypted in public to be paid out, which is why those steps take a minute longer. Once your money is sealed, what you do with it stays private.

Decryption credits are bought in plain USDC only. So when what you want is cUSDC, from ETH or from USDC, the bureau can keep a share of it plain: none, 5%, 10% or 20%, the choice is remembered. From ETH that takes two buys on the ramp, one plain and one sealed, at the same fee; from USDC, only the rest is shielded. The bureau shows the USDC kept and how many credits it buys at least. The credits themselves are sold only at the bureau, in a window of their own to the left of the counter (under your holdings on a narrow screen), since they are spent rather than held: pick a quantity, see the price, buy. When the plain USDC is short, it sends you back to the counter to get some.

Croquettes are the game's money, and they come in two forms. CROQ is a plain ERC-20 with a fixed supply of 20,000,000: nothing can mint more, and it has no decimals, so one CROQ is one croquette. Being plain, any market can list it. cCROQ is the same croquette wrapped into a confidential token (ERC-7984): balances and transfer amounts are encrypted. The game only ever uses cCROQ.

The whole supply was minted once, at deployment, and split like this:

Croquettes reach players from the Pantry, the contract that runs the economy. Every box someone bought brings a welcome bag of 100 the first time it is claimed for: once per box, whoever holds it, so a second wallet earns nothing. Then each box purrs: every day, an encrypted amount between 0 and 4, multiplied by 2 for a Vet Certified box, collected up to 7 days at a time. An empty id, one a mint creates beyond the quantity bought and that nobody holds, gets no bag and no purr. Bags and purrs are paid into the box, an encrypted stash, and whoever claims receives the stashes of the boxes they hold, and nothing for the others. So nobody can spend another holder's days. A claim lists its box numbers in public, so the app never lists only yours: it claims for whole rows of ten numbers (0 to 9, 10 to 19, and so on), always the same rows, one transaction per row. Anyone watching learns at most that you may hold one of those ten. The purr halves every year, and the reserve pays a whole claim or none of it. Nobody but the claimer sees how much arrived.

The rats you adopt in the studio earn croquettes too, but not from the Pantry: each one gets 3 plain CROQ a day from the rats' own pantry, collected from "My rats", 7 days at most between two collections. Plain, not confidential: who owns a rat is public, so what it earns may be. That pantry got 500,000 CROQ from the treasury; the game reserve that feeds the boxes is not touched.

Only the holder feeds their cat: at most 2 meals and 1,000 croquettes a day, however they are spread. Who holds the cat, how many meals it had today and the amount are all checked under encryption: a meal past the limits, or from someone who does not hold the cat, moves 0, silently. An offer past what is left of the day is cut down to it. Your browser encrypts the amount and the cat eats it all: its weight goes up by that much, encrypted, and nobody can read it while the box is sealed, the holder included. The croquettes are split: 20% to the collection's treasury, 60% back to the reserve that pays the purr, 20% burnt. Nobody can read the treasury's share between collections, the treasury included: read after each meal, it would tell who fed which cat and how much. It is sent to the treasury at most once every 7 days. If you hold less than you offered, the meal moves nothing, with no error and no hint. The meal itself is public and names the feeder, and the app only feeds cats you hold, so a meal shows that you hold that cat.

Once the box is opened, anyone can weigh the cat: its weight is decrypted in public and sets its build. Each cat also has a tolerance of its own, drawn from its seed. Nobody can know it while the seed is encrypted, and once it is public the cat has stopped eating. Weighed at or past it, the cat is sick: an ultra-rare trophy, never a death.

The weight follows the box, and so does its stash. A buyer knows nothing of its meals: not how many, not how much, and not how close it is to its tolerance. The seller at least knows what they served themselves. The market prices the rest.

Nobody can read a weight before the box is opened, the holder included, for the same reason nobody is ever allowed on a seed: an access grant cannot be taken back, so a past holder would keep reading it after a sale. What stays secret, and what does not:

There is no official price. Their value shows up indirectly, in what a heavy sealed cat sells for.

The public market is a Uniswap pool where CROQ trades against USDC. The collection put only croquettes in it, no dollars, so they sell from 0.001 USDC each upward, and never for less: selling only gives back the USDC that buyers brought. Until someone has bought, there is nothing to sell into, and the bureau de change says so. The pool's croquettes are locked in it for good: nobody can take them out, the collection included. Each trade pays the pool a 1% fee, which goes to the collection's treasury.

The studio is a page of its own, open to anyone, wallet or not: there you draw one of the depot's rats yourself. Rats, not cats, on purpose: the cats only come out of boxes, so nothing drawn in the studio can be taken for one. The button Another rat asks the game's own rat generator for a random one, in your browser: procedural, free, endless, and in 3D, turned with a drag. Buck teeth, big ears, a hat or a wedge of cheese, as the seed falls. No AI and nothing on-chain.

Drawing a rat from your own words goes through paid AI services, so it is sold first, in packs bought on-chain in plain USDC from the StudioPacks contract: the Starter pack, 2 USDC for 10 sketches and one 3D model, and the Litter, 8 USDC for 50 sketches and five 3D models. The payment goes straight to the collection's treasury and the units never expire. A purchase is public, like any plain USDC payment; what you draw with it is not on-chain.

A sketch is one cartoon picture of your rat, drawn by the AI from what you wrote inside a fixed style, so it always comes out in the depot's look. It is cheap: try again until the rat looks right. A 3D model turns one of your sketches into a mesh that the page draws with the game's toon shading and outline, breathing slowly on the turntable. It takes a minute or two. A switch at the top of the page goes from the free random rats to the AI desk. A sketch shows up big on the drawing board, and you turn it into 3D from there. While the AI works, a rat runs in its wheel over a progress bar; you can leave the page, the work goes on, and the bar is back where it was when you return.

To spend your units, sign in once with your wallet: a free signature, no transaction, that tells the studio which units are yours. The site spends a unit before it calls the AI and gives it back if the service fails, up to three times a day: past that, or when the AI's safety checker refuses the picture, the unit is spent, since the service was paid. A prompt is 3 to 240 characters; licensed characters and adult content are refused before anything is spent. Each day the studio stops at a spending cap: past it, come back tomorrow.

On the testnet the USDC is pretend money while the AI costs real money, so the AI studio may be closed or kept to a list of testers there (the "Draw with AI" tab is then greyed out, and a tester opens it by signing in with their wallet); the random rats stay free everywhere.

A rat you like in the studio can be adopted: minted as an NFT of your own in the Rats contract, paid in plain USDC straight to the collection's treasury. A random rat costs 1 USDC and is adopted by its seed, each seed once: its look is worked out from that number again wherever it is shown, so there is nothing else to store. An AI rat costs 3 USDC: its picture is first stored on Arweave for good, like the cats' pictures, while its 3D model is kept by the game's server.

There will only ever be 700 random rats and 300 AI rats, set for good in the contract, and one wallet adopts 5 at most, both kinds together. A rat can still be given or sold to a wallet past that. The studio and the home page show how many are left.

A rat is everything a box is not, on purpose: the cats are the depot's secret residents, the rats its open ones. Who owns a rat and what it looks like are public, so it works like any NFT. It keeps one secret only: its power, below.

Each rat earns 3 plain CROQ a day from the day it was adopted. They come from the rats' own pantry, the RatPantry, which got 500,000 CROQ from the treasury, and not from the Pantry that feeds the boxes: the rats never touch the game reserve. Collect them from "My rats" in the game, for all your rats at once. A rat keeps 7 days at most between two collections; left alone longer, it earns nothing more. If the pantry is ever empty, collecting fails and the days wait; when it runs low, it pays what is left. The croquettes are plain because a rat's owner is public anyway: there is nothing to hide in what it earns. Sealed at the bureau de change, they can feed a cat.

Every rat gets a secret power when it is adopted, random or AI, bought or given: 1, 2 or 3, drawn under encryption, so nobody, the team included, can choose or predict it. Only its holder can read it: in "My rats", press Read it. If you buy a rat, the first reading asks your wallet once for the right to read it; the seller keeps knowing what it was.

A rat also sniffs. In "My rats", type the number of a sealed box you do not hold and press Sniff: your rat tells you one of its traits, for your eyes only. It is a paid shake, 2.5 cUSDC: 70% waits in the box for its holder, 30% goes to the treasury, and everyone else only sees that a rat sniffed that box. A power-1 rat gets 0.75 cUSDC of it back from the treasury, in secret: nobody can tell which rats sniff cheaper.

That is how a rat helps before a purchase: a few sniffs of a box you are thinking of buying, and you know as much about it as the seller did.

A rat can also be set on a sealed box for 3 days; then it rests 7 days before it can go again. Type the box's number in "My rats", pick the trait to block (it only counts for a power-2 rat), and set it on the box. What it does depends on whose box it is, and the contract works that out by itself, in secret:

On one of your own boxes, it protects it. Whoever pays to shake it, or sends a rat to sniff it, reads a fake for the traits your rat blocks: the same fake every time, so it looks real. You still read the truth. Before a sale, that keeps your box's best traits to yourself.

On someone else's box, it attacks it. When its holder shakes their own box, the traits your rat blocks come back scrambled for 3 days. They learn that someone jams them, never who. A box protected by a power-3 rat resists attacks.

Every rat has the same button, the same 3 days and the same rest, so the chain only shows "rat 12 sat on box 340": not whether it protected or attacked, not its power, not which trait. A power-1 rat set on a box does nothing at all: a perfect bluff. Duels are not affected: the trait a loser shows is always the true one.

The flea market sits behind the depot, open after hours. Players sell each other sealed boxes, cats (boxes already opened) and rats, paid in cUSDC. Open it from the menu: Flea market. Each item hangs under a striped awning with its price tag, and three big buttons wait at the entrance: Mint a box takes you to the shelf for a brand new one, Mint a rat to the studio, and Sell to your own stall.

There are two ways to buy. The first is the price on the tag, which is public, and it takes two steps. Buy pulls the price from your cUSDC, all or nothing: what reaches the market is the whole price or zero, encrypted, so your balance stays sealed. Then one bit, paid or not, is decrypted in public and carried back on-chain with its proof, and the market settles. If you paid and the item is still as it was listed, it is yours. If someone else's purchase settled first, or the seller retagged it or took it back, you get back exactly what left your wallet. If your cUSDC did not cover the price, nothing was taken.

The second is a secret offer. Write an amount and press Seal it: your browser encrypts it, and the market holds it in escrow. Only you and the seller can ever read it; everyone else only sees that an offer was made. The seller breaks the seals, one signature for every offer on the stall, and may accept one at once: the item goes to you, the escrow to the seller, and that price is never published. An offer from a wallet that could not cover it holds zero, and the seller sees that. Until it is accepted you can take your offer back at any time, even after the listing is gone. The figure in How things come out plays both ways, step by step.

Whichever way an item sells, 2.5% of the price goes to the depot and the rest to the seller. The contract can never set that cut above 10%.

A box is sold in the public state it was listed in: sealed or opened, entangled or not, vet checked or not. If that changes while it is on sale, say its entangled partner is opened and opens it too, buying it or accepting an offer on it is refused, and a purchase still pending is refunded.

A sealed box on a table can still be sniffed: a paid shake tells you one of its traits, for your eyes only, as with any box. The holder's share of what you paid waits in the box as usual, and whoever buys the box collects it. Before buying a sealed box, assume the seller has shaken it; a few sniffs level that.

To sell, press Sell, pick a box, a cat or a rat, and set a price. The page shows what you get once the depot's 2.5% is taken, and buyers may also slip you sealed offers. Your boxes are known only to you, so finding them takes one signature to read your receipts, as Show my boxes does.

A rat is a plain NFT: it goes to the market and is listed at once. A box is not so simple, since nobody can check who holds it, the market included. So it goes to the market in a maybe transfer, like any gift, and whether it arrived is then decrypted in public. Only if it did does the listing open, so only a box's real holder can sell it, and once the market holds it nobody else can list it. Until then it shows as On its way.

Selling is a public act: selling a box shows everyone that you held it. What is inside stays sealed, for you as for the buyer. The seller of each listing, its asking price, the buyer of each sale, and whether each buyer at the asking price could pay are public. Balances, offer amounts and the price of a sale by offer never are.

While an item is on sale, Retag changes its price (purchases pending at the old price are refunded), and Take it back brings it home. Buyers keep their sealed offers to take back.

The flea market is open on Sepolia, with test dollars. In the demo, the night shift keeps a few stalls, slips a secret offer onto whatever you put on sale, and takes any offer worth at least 70% of your asking price.

The game runs on Sepolia, Ethereum's test network. Nothing here is worth money. The USDC is Zama's test token, free from the wallet slip or the bureau de change; the ETH for gas comes from a faucet; the croquette pool only exists so the market can be tried; and every price in this manual is a test price.

The mainnet allow list has 1,500 seats, first come, first served: a seat goes to each player who claims one, or who connects an X account on the boarding page, until none is left. Your points: 3 for each opponent you beat in a duel, 1 for each opponent you faced, 2 for each box you opened, up to 10 boxes. A wallet linked to your X boarding pass gets 5 more, and 3 more again once you joined the Discord server and ran /board there with the code the boarding page gives you. Each friend who boards from your referral link adds 2 more, up to 10 friends, once their pass holds a seat with a wallet linked. Each opponent counts once, however many times you meet, and duels between your own wallets count nothing. Claim your place from the leaderboard's Duels tab by signing with your wallet: it is free and sends no transaction, and it tells the game only that your address is asking. Sign again later to update your points; the best you ever had are kept, even if the test network starts over. Claimants are ranked by points; between equal points, the earlier claim goes first.

Every seat comes with a gift, set by your rank among the seated players when the list closes. Ranks 1 to 500 fly First class: 100 to 500 cCROQ, a sealed box and a rat. Up to rank 1,000, Business: 50 to 250 cCROQ and a box. Up to rank 1,500, Economy: 20 to 100 cCROQ and a rat. The croquettes are drawn at random under encryption: only your wallet can read how many. The box is minted free for you out of the boxes kept outside the sale, so a sold-out sale never empties a gift; the rat is a free one, its seed drawn at random. Both are public, like any box's first holder after a mint of one. A gift nobody collects is never minted. The gift is collected on mainnet, in one transaction from the same Duels tab, within 30 days of the list closing, by a wallet that claimed its place: a seat held only by an X account has no wallet to send it to.

The contracts on Sepolia: