Order/Flow

The setting

What this is

Order Flow is a risk protocol for NFTs. It is a fork of Wolf Game, ported to Robinhood Chain and rebuilt around a source of randomness that nobody involved can steer.

The honest statement of what is new is narrow, and it is worth stating narrowly. Your NFT can take another player's NFT, and the token that NFT produces, on the chain itself — and no operator, no sequencer and no player is able to choose who wins. Two things happen without your consent and without anybody's discretion:

• A newly minted token past the paid tranche has a 10% chance of being internalized — delivered to a randomly chosen staked Maker rather than the wallet that paid for it. The weighting across Makers is by Alpha.
• A Retail position leaving The Exchange has a 50% chance of having every $FLOW it accrued routed to the Makers instead of to its owner.

Everything downstream of those two rolls is deterministic and public. What makes the claim defensible is not the game design, which is inherited — it is that the entropy driving both rolls does not exist at the moment you pay for them, and is fixed in advance by a party that never learns it in time to matter. Section 9 is the whole argument.

Everything else lives on-chain: the traits, the pixel art, the accounting, the rolls. There is no metadata server, no roadmap, and no discretionary switch that redirects an outcome after it has been requested.

The terms

• There will only ever be ···· Gen 0, minted for ···· each. The ···· Gen 1 are minted by burning $FLOW. ···· in total, ever.
• Retail can be staked on The Exchange to earn $FLOW, and pays a ···· rebate to the staked Makers every time it settles.
• When Retail leaves The Exchange, the Makers roll to take everything it has accrued. Leaving requires ···· since the position was opened or last settled.
• When a token past the paid tranche is minted, the Makers roll to internalize it. If they succeed it is routed to a staked Maker, not to the buyer who paid.
• Makers carry an Alpha from · to ·. Higher Alpha means a larger slice of the rebate and a better chance of catching a mint. Only staked Makers earn or take anything.
• Every roll resolves in a later block than the one that paid for it. Minting and exiting are therefore two transactions each, not one.
• Up to 10 tokens per mint transaction. No per-wallet cap is enforced on chain.

Contracts

Live on Robinhood Chain testnet. Everything on this page is read from these addresses when the page loads — nothing below is transcribed by hand unless it is marked as a compile-time constant.

Game status

Minted

····of ····

Retail staked

····on The Exchange

Maker alpha staked

····sum of Alpha in the pack

$FLOW in circulation

····faucet paid ····

Beacon requests

····rolls served since deploy

Operator bond

····slashable on a stall

reading chain… Re-read chain

value read from the chain when this page loaded — hover for the exact call. value a constant compiled into the deployed bytecode: real, but not stored in a slot any eth_call can return, so it is transcribed from the source and labelled as such.

Minting

Minting out the whole collection burns ···· $FLOW. That figure is the sum of the three bands above, each one read from mintCost() and multiplied by the width of its band — it is not a target, it is what the schedule adds up to.

A mint is two transactions

This is the one place the chain forces a change on the original design, and it cannot be avoided. Read section 9 for why. Mechanically:

1. commitMint(amount, stake) — payable You pay, the token IDs are reserved, and a randomness request is registered. No token exists yet. Nothing about the outcome is decided or decidable at this point; the entropy it will use has not been produced. If you passed stake = true, anything that survives the roll goes straight onto The Exchange without a second approval.
2. the roll matures The beacon fixed a seed block two L1 blocks ahead of your commit. That is roughly 24 seconds of real time. Until that block is mined and the operator reveals its next hash-chain link, the answer does not exist anywhere.
3. revealMint(requestId) Traits, faction and the internalization roll all resolve, and the tokens are minted. This call is permissionless: anybody can push it, including a keeper. That is deliberate — the outcome takes no private input, so allowing only you to submit it would let you sit on a result you disliked.

Retail

You have a 90% chance of minting Retail, each with its own traits drawn from the rarity tables held in the NFT contract. Retail is the only thing in this game that produces $FLOW, and the only thing that carries risk.

Makers

You have a 10% chance of minting a Maker. Every Maker carries an Alpha score from · to ·, stored as alphaIndex and read back as MAX_ALPHA − alphaIndex. A higher Alpha buys exactly two things:

• A larger share of the rebate paid by every settling Retail position.
• A better chance of being the Maker that catches an internalized mint.

Both are strictly proportional to Alpha, and both are zero unless the Maker is staked. An unstaked Maker is a picture.

The Alpha curve

Alpha is not uniform, and the skew is steep. The distribution below is computed in your browser from the alias tables held in the NFT contract — rarities(17, i) and aliases(17, i), drawn exactly the way selectTrait draws them.

How the split works

The Exchange keeps a single accumulator, flowPerAlpha. Every rebate payment adds amount / totalAlphaStaked to it. A Maker's claim is alpha × (flowPerAlpha − snapshotAtStake), so the arithmetic is constant-time regardless of how many Makers are in the pack, and joining late never dilutes what someone else has already accrued.

Two staked Makers, one at Alpha · and one at Alpha ·, split every unit of rebate ···· to ····. An internalized mint lands with them in the same ratio. If no Maker is staked at all when a rebate is paid, it is held in unaccountedRewards and paid to whoever stakes next — it is never burned and never returned to Retail.

Both figures are the expected split of ···· at the coded draw rate, not a supply guarantee. The contract does not reserve a Maker quota; a run of luck moves the real number either way.

$FLOW

Supply and emission

$FLOW is a plain ERC-20 minted by The Exchange as staking rewards and burned by the NFT contract on Gen 1 mints. Two numbers govern the whole economy, and both are constants in the deployed Exchange:

Those two together are the emission schedule, and the consequence is worth stating plainly rather than burying: because the rate is per token, the faucet drains faster the more Retail is staked. With N Retail on The Exchange, the remaining budget lasts remaining ÷ (N × ····) days. At the population staked right now:

Faucet budget

····MAXIMUM_GLOBAL_FLOW

Paid out so far

····totalFlowEarned

Runway at current stake

····derived, changes with every staker

Where the rest of it goes

• Burned on Gen 1. Minting out ids ···· destroys ···· $FLOW — more than the faucet will ever emit. The sink is designed to outrun the source.
• Rebate. ···· of every Retail settlement is redirected to staked Makers. This is a transfer, not an emission: the total minted is unchanged, only the recipient moves.
• Slippage. $FLOW taken on a failed exit follows the same path into the Maker pool. Again a transfer, not a burn.

How the randomness works

A game where an NFT takes another player's NFT is only worth playing if nobody can decide who wins. This chain gives you nothing to build that on, so the game brings its own.

Why nothing native works here

• blockhash(block.number − 1) is byte-identical across roughly 150 consecutive L2 blocks — about fifteen seconds — and identical for every transaction inside that window.
• block.prevrandao is the literal constant 1.
• block.timestamp yields about four bits per plateau.
• All sixteen canonical VRF coordinator addresses are codeless on this chain.
• eth_call with state overrides is enabled, so anything computable inside your transaction is computable for free before you send it.

Put together, that means any outcome resolved in the paying transaction is knowable in advance and, worse, is knowable for long enough to act on. A player who disliked a mint would simply not send it.

The construction, in plain language

The operator picks one secret value at random and hashes it repeatedly, producing a long chain that runs one way only. It publishes just the far end of that chain — the head — and keeps every link behind it private. Because a hash cannot be run backwards, publishing the head proves the whole chain was fixed before anyone made a request, without revealing any of it.

A roll then mixes two ingredients. One is the next unrevealed link of that chain. The other is the hash of an Ethereum L1 block two blocks in the future — a block that provably did not exist when you paid. Both are needed, and no single party holds both.

// committed once, long before any request
  x_n ─► … ─► x₂ ─► x₁ ─► x₀      each arrow = keccak256
                       └── published as headCommitment
                            everything to its left stays secret

// one roll
  t+0    you sign            commitMint / commitExit → requestId
         beacon records      seedBlock = L1 height + 2
                             that block does not exist yet

  t+24s  sequencer produces the seed block
         its hash is now fixed and public

  t+…    operator reveals x₁
         word = keccak256(x₁, keccak256(requestId, blockhash(seedBlock)), requestId)
         head advances x₀ → x₁   the next link is still secret

Who can cheat, and why they cannot

The operator's only remaining power, and how it is removed

Everything above still leaves the operator one lever: it can refuse to reveal. It cannot steer an outcome, but it could sit on one it dislikes. So the beacon removes that too. 64 L1 blocks past the seed block — about thirteen minutes — anyone may call settleStalled(requestId). That derives the word from the seed block hash alone, without the operator's chain, and pays the caller 0.001 ETH out of the operator's bond.

The bond currently standing behind that promise is ····, and it can only be withdrawn after a seven-day notice period, so collateral cannot be pulled in the same block withholding starts. The bond does not secure fairness — the construction already does that — it secures liveness, which is the only thing left to secure.

Why this is a fork, not a clone

The 2021 original resolved every roll — faction, traits, theft — inside the transaction that paid for it, from a seed built out of tx.origin, the previous block hash, the timestamp and the mint counter. On Ethereum in 2021 that was weak. On this chain it is not a weakness, it is an open door: the previous block hash is frozen for about fifteen seconds, state-override eth_call is enabled, and the entire batch outcome can be read for free before paying. Anyone who bothered to simulate would take every good roll and skip every bad one.

So the seed had to move. Once it moved into a later block, the transaction had to split, and once the transaction split, the reveal had to be permissionless. Everything else in this fork follows from that one forced change. The rarity and alias tables are transcribed verbatim, so the intended curve is preserved exactly.

Six other defects came with the original code and were fixed rather than inherited. Each has a regression test in the repository whose only job is to fail if it ever comes back.

Two further changes are design decisions rather than bug fixes, and are listed separately for that reason. Trait generation no longer recurses unboundedly against a reseed the caller can also compute — the retry is derived from the committed word and bounded at ten attempts. And the rescue path out of The Exchange is not gated on the beacon, not gated on a pause flag, and not gated on the operator being alive; the original's staking contract was paused two days after launch and thousands of NFTs are still inside it.

Questions