The escrow pays by code: how a HIM prize room settles on Solana

When two people put something on the line in a game, the most important party is the one holding the pot. In most online games that is the operator, and the rules about who gets paid live in a database you cannot see.

In a HIM prize room the pot sits in a program on Solana. The split is written into that program. The questions are committed on chain before they can be drawn, and the result is committed after. This post walks through one room from start to finish, and is just as clear about what the code does not do.

Prize games are for players 18 and older and are not available in every country. Anyone can read this as a description of how the system works and check the chain themselves.

What we measured

• Split in the program: Prize rooms pay 85% of the pool to the winners and 15% to the platform, split by the escrow program. There is no creation fee.
• On mainnet: on 18 October 2026, a Solana mainnet prize-room test passed 17 of 17 checks, the split matched 85/15 exactly, and an independent replay of the transactions matched our own record. Chiliz mainnet rooms settled the same way between 2 and 5 October 2026.
• Who played: our own team. Every on-chain game so far is a team test.
• Proof Seal: 94 seal-signer signatures since 8 Oct 2026, 0 failed (read 23 Oct 2026).
• Disclosure: the escrow program is upgradeable; its upgrade authority is a team-controlled multisig. Independent signers and a time lock are planned before launch.

The short version

The escrow pays by code: prize rooms have settled on Solana and Chiliz mainnet at exactly 85/15, with public transactions. The escrow program is upgradeable; its upgrade authority is a team-controlled multisig. Independent signers and a time lock are planned before launch.

Those two sentences always travel together in what we publish. The first is the reason to trust the room. The second is the reason that trust is not yet complete.

One room, step by step

1. Connect

A player connects a Solana wallet with one signature: no transaction and no fee. Before any prize entry, a short human check decides whether that wallet can join. The check is short on purpose. It is a cost for scripts running many accounts, not a document check, and we do not describe it as proof of anything about the person.

2. Open the room

Someone opens a room. On Solana, a room is an account created by the escrow program. The creator leaves a small lobby deposit, which comes back when the room is played. There is no creation fee.

3. Entries go into the escrow, not to us

Each player's entry moves from their wallet into the room's escrow account. From that moment, the funds are held by the program, and the program only knows a few ways out: pay the declared result by its fixed split, or refund. If a room is cancelled, the entries are refunded.

4. The questions were committed before the round

For duels and league rounds, the question set was hashed into a Merkle root and written to Solana as a memo by our seal signer before any of it could be drawn. The root commits to the questions and their answer keys without revealing them. Paid Ball rooms are the exception: they are sealed after the round only. Either way, during the round the browser gets one question at a time and the answer key stays on the server.

5. The server keeps time

The question appears word by word, your clock starts when the answers fall, and points melt every 6 seconds. The server times every answer. In a duel, ranking is by points, then by the lowest total time.

6. Settle

When the round ends, the result is declared to the program and the program pays out: 85% of the pool to the winner, 15% to the platform. On Chiliz, rooms take up to 255 players and pay up to 20 places. Multi-place payouts on Solana are planned (live on Chiliz). On Solana today a room pays one place.

The split is two constants in the program, not a setting in our database. Changing it would mean deploying new program code, which brings us to the part we disclose every time.

7. Seal the result

After settlement, the result is hashed and committed to Solana in the same way. Anyone with the round's data can then run the open-source verifier against the chain. It passed a real mainnet league round with 39 checks.

What the code does, and what it does not

It is worth being precise, because "on chain" is often used to mean more than it does.

The program does:

• hold entries in an escrow account that the program controls;
• pay 85% of the pool to the winner and 15% to the platform, with no creation fee;
• refund entries when a room is cancelled;
• leave a public transaction for every step, which anyone can read on an explorer.

The program does not:

• judge answers. Our server times and scores the round and declares the result; the program enforces where the money goes once the result is in.
• prove the server behaved. A seal shows that nothing changed after the commitment; it does not show that the server never read an answer.
• cover every game. Free Token Rain and free Quiz are not sealed. The first result seals were our own test rounds.
• stay the same forever. It is upgradeable.

The upgrade authority

Upgradeable means that the people holding the upgrade authority can deploy new code to the same program address. For an escrow, that is the single most important fact to disclose, so here it is again in plain words: the escrow program is upgradeable; its upgrade authority is a team-controlled multisig. Independent signers and a time lock are planned before launch.

What we plan before launch is a 3-of-5 multisig with at least two independent signers and a time lock. A time lock would give anyone watching a window to see a pending upgrade before it takes effect. We will state that as a fact only once it is done.

Reading the code

The bytecode is public: anyone can read the deployed program on Solana. The escrow source will be published with a verified build at the next upgrade. A verified build lets anyone rebuild the source and confirm it matches the bytes on chain. Until then, we do not tell people they can check the source.

Security work so far

No external audit yet; an independent review is being arranged. Internal work so far: 17 security-scan findings fixed, ~59.6M fuzzing actions with no critical or high finding, 43 adversarial API probes.

Why put a mind game on chain at all

Because "trust us" is not a scoreboard.

A skill game with entries has two trust problems. Players need to know the pot will be paid as promised, and they need to know the questions were not changed after someone saw the answers. An escrow program answers the first. Proof Seal answers part of the second. Neither replaces the other, and neither is a reason to stop asking questions.

It also means the evidence does not depend on us. What you can check today: mainnet settlement transactions, the seal signer's memos and the open-source verifier. The program address is FwhHhZtqPmUaTX5VSVPsRVUK6LxKFceBkpYkYvigK4Y3 on Solana mainnet. Paste it into any explorer and read its history.

The honest state of things

The machinery works on mainnet. The use does not exist yet. Outside traction is about zero: every on-chain game so far is a team test, 0 human-checked answers have been counted and there is 0 gold. Revenue is about $0.

That is why we lead with the chain. It is the part we can show you working today, with transactions you can open yourself.

Start with the free round

You do not need a prize room to see how HIM plays. Today's free round is at him.finance: a couple of minutes, questions inside a game mechanic, the same server clock for everyone. Sign in to keep your place on the board, and connect a wallet with one signature, no transaction and no fee.

Then send the round to the friend who argues with you about who knows more. From your result screen, a challenge link lets them play the same questions against your recorded run. Where a prize room is open to you, it works the way this post describes.

Prize games are for players 18 and older and are not available in every country.