Syncing up Web2 games to the blockchain

Question

I was wondering if anyone could provide insight into the following:

Let's say I have a Web2 game where a character can run around, fight enemies, and eventually is able to open a chest to receive an item. Opening the chest in the game would trigger a request to some contract on chain to reward the player with an NFT that represents the item they get.

I'm struggling to understand how this can work in a secure way. Given anyone can access the on chain program and call the "open chest" function, how do people ensure that the request really came from the game, and that the player really did open the chest?

I started to go down a bit of a rabbit hole involving ZK proofs and transaction roll ups.. and thought I might ask here to see if anyone had any ideas.

Cheers

Answer 1

in general you can never trust the client. So there are some options how you can achieve this.

1. You can create an account when the player signs up for the game in which you save if a player already collected a chest, so that each player can only collect it once. If your whole games logic is in the smart contract this is the savest solution. You could then also add some milestones, first player needs to start level, then beat the boss, then he can call open chest. You could use a bitmap for that for example. Here is a hackathon game which did it like that: https://github.com/Woody4618/SolanaSummerCap_SolanaRPGQuest Here is a playground tutorial on how to save sol in a program and give it out to a player: https://beta.solpg.io/tutorials/tiny-adventure-two And another one that shows how to do it with SLP tokens: https://beta.solpg.io/tutorials/battle-coins
2. Since you where talking about a web2 game and the logic runs in the backend you can sign your transactions in your backend. This you can for example do using a next.js api. There you can very conveniently use the solana web3.js package. And then there you could only allow collecting a chest if your backend private key signed for the collect chest transaction. Here is an example on how to partially sign in the backend and then let the frontent client sign as well: https://github.com/solana-developers/one-milion-nfts/blob/main/next/pages/api/mint.ts
3. There is some research being done on the ZK side by magic block and some others. But if there is a proof generated by the client there is nothing stoping a bot to do the same probably. What you could try is some proof of play, where you generate something depending on the game play which the program will validate.