Archway Arcade Space

[wotori]

Hi everyone! Recently, I participated in a smart contract hackathon provided by Archway and implemented CW-Arcade and made a short video about it . Now, I am thinking about creating a platform where people can deploy their web-based games and other engine-based games using smart contracts on a single platform. It would be similar to platforms like https://itch.io/, but web3-based on the Archway blockchain. Does this sound feasible? Do you have any ideas or suggestions on how to approach this? I envision it as a comprehensive DevOps platform that can handle user code for web games (with github/gitlab e.t.c. repos), deploying them similar to how it works with Cloudflare, GitHub Actions, Heroku, and more (probably inside docker containers on Linux machine) on the specific dedicated powerful servers.

[emperorjm]

Hey @wotori. The idea presented is ambitious as it promises to combine the strengths of decentralized blockchains and web gaming.

I don't have experience using https://itch.io or playing arcade-type games in the browser, but after watching the video, a concern that came to mind is how do you ensure the integrity of the scores submitted on-chain?

If the game logic is client-side, players could manipulate the game or even use the browser's developer console to submit false scores. Perhaps a partial solution might be to centralize the games slightly, implementing some network controls to prevent users from gaming the system, especially when verifying scores.

My friend Luca (@lufa23) would undoubtedly value the integration of cryptographic proofs or zero-knowledge proofs to deter any dishonest actions which could also help with confidence in the system but such solutions might be out of reach as of now.

[wotori]

I understand your concern regarding the integrity of scores submitted on-chain, especially if the game logic is client-side.

To address this issue, it is advisable to execute the transaction from the back-end side. By handling the transaction on the server, we can ensure that the scores are not directly submitted by the users. This approach allows for better control and verification of the data before it is stored on the blockchain. This is the main layer of integrity and in between user and back-end execution we can do whatever checks we want.

Additionally, implementing mechanics to detect cheating or fraudulent activities is crucial. This is what can exist between the user and the server. Monitoring user input, game activity, and analyzing patterns can help identify suspicious behavior. For example, if a player achieves an unusually high score within an exceptionally short period, it might raise a red flag. By monitoring and analyzing these factors, we can help maintain the integrity of the scores.

I appreciate the concept of utilizing zero knowledge proof, as it enables the creation of a decentralized application that can for example verify a user's game activity, which is recorded during the game session. If everything is in order, the zk validator can then sign the transaction, thus permitting the storage of the score on the blockchain.

The safety you are referring to is achievable, but I believe it should not be the top priority initially. The platform could begin to grow with simple and less complex anti-cheat mechanisms, which can be improved along with the platform's expansion.

p.s.
Try to achieve a score of 100 billion on the Pacman. I am confident that it is possible, but it is not a simple task. The code is compiled, and you will need to spend a significant amount of time debugging it in order to figure out how and which variable needs to be modified and when...

[zanicar]

The first step would be to analyze how cheaters operate.

Simply submitting a bogus score is doable, very unsophisticated and easy to detect... and this is not the general phenomenon we observe;

Sophisticated cheaters or hackers use "trainers", which repackage game logic in the equivalent of a debugger, granting them access to internal game state available to the program, but not necessarily to the player. For example, map data can be analyzed and used to reveal in an overlay, the location of valuable loot (such as an op weapon / power up); the same can be used to reveal the location of opposing players (wall hacking), etc.

In an arcade style game a trainer can be used to modify AI behavior, for example in "pacman" a hacker may chose to override the direction of the ghosts whenever they move towards the player, effectively guaranteeing that they will always choose a path moving away. A very sophisticated hacker may even algorithmically guarantee that the player will always have at least one viable escape path available, thus detecting this type of trainer becomes increasingly difficult.

Many AAA multiplayer / online games are plagued by cheating. The only way to effectively address this is to run tournaments where the organizers provide the hardware and software installation where competitors may typically only bring their own peripherals, and there are even recorded cases where competitors tried to sneak in and execute trainers via their keyboard / mouse.

I am not mentioning the above to discourage your idea, I am mentioning it as anybody with experience in this regard will likely field these concerns and you'd best be prepared to answer or address these matters!

[wotori]

I fully agree with everything you said. However, as I mentioned down below, I am strongly inclined to believe that we should first provide users of the platform with the motivation to play and hackers to hack. By doing so, the hackers themselves will assist us in developing robust protection mechanisms. At this stage, ghost hackers do not pose a significant threat, and basic protection can be bypassed through a socket connection and validation of variable states.

[ethanill]

Arcade-style gaming is something that could work naturally well with Archway's reward mechanism; allowing a monthly prize pool to accumulate from day-to-day usage for example. Perhaps users can practice any game for free, and then when they want to take a run at a scored session they have to interact with the chain and submit a transaction (before they achieve their score). This mirrors typical multiplayer online games with casual/ranked modes.

As @emperorjm mentions the key issue to solve here is the integrity of user scores, this bleeds into the question of which elements are then made on-chain for validation. If you can come up with a robust anti-cheat architecture then this one really has legs imo!

[wotori]

So we are kind of ending up at the point where if there is no strong anti-cheat mechanism, we cannot start building such a platform. I believe it would be better to address this issue during the alpha release of some arcade machines with real users and various use cases. We can validate certain rules in the game, such as ghost/packman and other states of game objects related to movement e.t.c., via a socket connection to a remote host. In the event of a change in game environment states or a loss of connection, the user will be flagged as a cheater.

I understand that this is an important issue that can significantly damage the platform's reputation. However, I would like to point out that it is not the number one issue that needs to be resolved, especially considering that there are still many other questions to address, such as game hosting and integration with deployed smart contracts. Without addressing these issues, we won't even encounter the problem of cheating. Do I correctly understand the point that the cheating problem should be resolved before discussing or developing any other parts of the platform?

From the developer perspective, I am not truly motivated to work on anti-cheat software when I don't have platform with games and users to defend. As engineers and architects, I think we have a good idea of the mechanisms that can be used as the initial basis for protection against cheaters, with which we can start from and then gradually refine and improve them.

To achieve a comprehensive solution, I envision an API that allows users to configure an SSL connection to the game server. Through this API, users can specify variables and object states that the remote server should analyze and monitor to ensure they are kept as configured by the game designer. This will provide a strong defense against cheaters.
Additionally, the game could possibly be rendered in an iframe as an extra layer of security, but this is another topic that requires further research.

p.s.
I also think that preventing cheating is an ongoing process that may require continuous monitoring, updates, and improvements to stay ahead of cheaters that can only been done in development->production process with real users and real cheaters motivated to cheat.

[wotori]

Regarding the transaction, it involves storing the game score released by the server side and accepted by the client side through in-game code, similar to the Pac-Man example. Users are unable to execute this transaction themselves, and our responsibility is to safeguard the game code that sends this api call to our server from manipulation by hackers. This API call should be signed by that validator socket server and had a short lifetime, probably JWT token can do the job.

[wotori]

Hi there, just for the record, there could also be a platform that allows developers to contribute the code of the game to the blockchain-based repository. In this platform, all commits that are merged into the main branch and become part of the production build will be counted. At the end of each month, the smart contracts will distribute awards from the pool, which can be in the form of currency or any other kind of reward, among the developers. I am implementing the similar model in the Stellar project for virtual collaboration in developing 3D content.

[wotori]

One more question: Is it possible/reasonable to incorporate a socket connection architecture block into the archway network to ensure security and online communication between users in MMO games? Or this could be another cosmos based blockchain network to serve this purposes?