The Flip

$1 USDC entry. Pick 20 predictions. All 20 coins flip at once each round. Match the first 14 to win the entire jackpot. Live on Solana devnet.

This repository mostly implements the advertised Solana devnet coin‑flip game, but several red flags mean you should proceed carefully: 1) Do not run remote curl | sh installers from unknown domains — use the official Solana installer or install through trusted channels. 2) Create and use an isolated devnet-only keypair (do not use a mainnet wallet or your primary keys). The demo script will read ~/.config/solana/id.json or ANCHOR_WALLET by default — be explicit about which key you pass. 3) Avoid posting your wallet publicly; use an official faucet or a wallet you control for devnet funds. 4) Expect the demo to require Anchor/IDL files; the code references a different IDL path than provided — you may need to run anchor build or copy the IDL before running commands. 5) Review the on‑chain program address in a block explorer and, if you plan to send value (even devnet tokens), audit the Rust program logic (included) to verify payout/withdraw rules. If you are not comfortable with these steps, test in an isolated environment (VM or throwaway account) and don’t use real/mainnet assets.

Type: OpenClaw Skill Name: the-flip-publish-2 Version: 0.1.0 The skill bundle is a complete and transparent implementation of a coin-flip gambling game on the Solana devnet. It includes a Rust-based smart contract (program/src/lib.rs), a Node.js CLI tool (app/demo.mjs) for game interaction, and a Next.js web dashboard. The code uses standard blockchain libraries (@solana/web3.js and Anchor) and follows expected patterns for Solana development. While the randomness generation in the smart contract relies on on-chain variables (slot and timestamp) which are technically predictable by validators, this is a common design limitation in simple blockchain games rather than an intentional exploit. The CLI tool accesses the standard Solana config path (~/.config/solana/id.json) to sign transactions, which is necessary for the stated functionality. No evidence of data exfiltration, obfuscation, or malicious prompt injection was found.