Home / Tech spec

Technical specification

What ships in the source delivery.

Measured from the current build of the platform: the Unity client, the game server, the slot engine, the database, and the admin console. Every package — from the $999 single game to the 30-game bundle — includes all of it.

At a glance

Game client
Unity 6 (6000.3), URP 2D, Addressables, Unity Localization
Build targets
Android (IL2CPP, ARM64, API 25+), WebGL, macOS
Game server
C# · ASP.NET Core 8 (.NET 8) · REST · SignalR · Swagger / OpenAPI
Database
MySQL or MariaDB via Entity Framework Core, 17 migrations
Admin console
Web console with 11 permission areas (UI in Korean)
Client languages
12 · ko en ja zh-Hans zh-Hant fr it de tr ru es pt
Source code
≈82,000 lines client C#, ≈45,000 lines server C#, ≈8,000 lines admin web UI
Tests
≈650 EditMode + ≈35 PlayMode client tests; 19 offline engine golden suites
Games
13 titles, each a JSON math definition plus an art pack

01

Game client

One Unity project runs every title. The client only animates results: reels, wins, balance, and features are decided by the server.

EngineUnity 6000.3.20f1 · Universal Render Pipeline 17.3 (2D renderer) · uGUI · Input System
Key packagesAddressables 3.1 · Localization 1.5 · Newtonsoft JSON 3.2 · Timeline · Visual Effect Graph
Build targetsAndroid (IL2CPP, ARM64, min API 25) with a command-line signed-APK build and an offline "all games inside" demo APK; WebGL; macOS
Content packagingEach title is a remote Addressables group downloaded on demand; the lobby and shared UI ship in the app. The game server can host the bundles itself at /addressables.
Code layoutBoot, Core (wire models), Game (slot machine, reels, bet, lobby, hold & win board), Net (REST client, asset loading), UI (HUD, rules and paytable pages, localization), Timeline (server-event presentation), Editor (build and art tooling)
NetworkingREST over UnityWebRequest with JWT bearer auth. Spin commands carry protocol version 2 and a fresh idempotency key; one safe retry reuses the same request bytes.
EmbeddingA CasinoSlotPanel entry point lets a host Unity app list the games and launch them with its own session token; an exporter packs the runtime as a DLL SDK.
Localization12 locales, a shared UI string table (165 keys), and per-title rules pages; language picker plus device-locale detection
Tests65 EditMode and 8 PlayMode test files (≈686 test cases by source count)

02

Server & API

A single ASP.NET Core 8 service hosts the game API, the SignalR hub, the admin console, and optionally the client's content bundles.

Stack.NET 8 · ASP.NET Core · EF Core (Pomelo MySQL 8.0) · JWT Bearer · BCrypt.Net · Swashbuckle
Startup checksValidates every game definition, applies database migrations, and checks pinned feature sessions; the server refuses to start on invalid data.
Background workScheduled math deployments publish at a set UTC time.
HealthGET /health

API endpoints

EndpointAccessPurpose
POST /api/auth/registerPublicCreate a player account
POST /api/auth/loginPublicSign in; returns a JWT with balance and wallet revision
GET /api/gamesPublicLobby list, optionally with maintenance status
GET /api/games/{id}/configPlayerReels, paytable, bet ladder, features, math version and hashes
POST /api/games/{id}/spinPlayerPaid spin, free spin, or feature buy
POST /api/games/{id}/commandPlayerFeature commands such as the free-spin choice
POST /api/games/{id}/gamblePlayerDouble-or-nothing on a pending win (off in all 13 titles)
GET /api/games/{id}/sessionPlayerReconnect to an unfinished feature
GET /api/wallet/balancePlayerBalance and wallet revision
/api/admin/*Admin (per-area permission)42 endpoints behind the admin console
/hubs/livePlayerSignalR hub pushing balance and jackpot updates

Protocol guarantees

  • Idempotency keys: every command writes a durable receipt; a retry with the same key returns the stored response, a different request with the same key is rejected.
  • Session and wallet revisions act as concurrency tokens, so stale or duplicated commands cannot settle twice.
  • Money is carried in integer minor units (4 decimal places); the server derives and checks the stake instead of trusting the client.
  • One canonical error body with 39 machine-readable codes and a retryable flag.
  • Each round returns an event list, a final snapshot, the next available commands, and the math version and hashes it was produced with.

Spin request

POST /api/games/{gameKey}/spin
Authorization: Bearer <jwt>
{
  "protocolVersion": 2,
  "command": "bet",
  "gameKey": "{gameKey}",
  "bet": 1.0,
  "lines": 20,
  "stakeMinor": 200000,
  "currency": "XGC",
  "idempotencyKey": "7f3c…",
  "sessionRevision": 41
}

Spin response (excerpt)

{
  "roundId": "…",
  "state": "base",
  "reels": [[3,7,1],[…]],
  "win": { … },
  "freeSpins": { … },
  "events": [ … ],
  "availableCommands": ["bet"],
  "balanceMinor": 998000,
  "walletRevision": 1043,
  "mathVersion": "…",
  "mathHash": "…"
}

03

Slot engine

One data-driven engine runs every title from its JSON definition. New games are mostly new definitions and art, not new server code.

Win evaluation

Paylines, ways (fixed or variable rows), pay-anywhere, and row-anywhere evaluators, plus cascades (tumbles) and a max-win cap.

Features

Free spins with retriggers and random awards, player-choice free-spin packages, hold & win, gem respins, sticky, multiplier and raining wilds, repeat-win free spins, adjacent-reel scatter pays, feature buy, ante and super-spin bet modes, gamble.

Jackpots

Shared progressive pools fed by every paid stake, paired progressive jackpots, and fixed-tier jackpots paid as multiples of total bet.

Random numbers

Cryptographic RNG (.NET RandomNumberGenerator) in production; a seeded RNG for simulations and tests. Every round's full result is stored, so any round can be replayed in the admin console.

RTP control

A server-side payout governor keeps each game's measured RTP near the target the operator sets in the admin console, within a shared payout bank. Configurable correction rules (such as dead-spin and free-spin guarantees) can be tuned or switched off per title.

Math definitions

Each title is three JSON parts — base game, free game, and logic — with SHA-256 math and definition hashes. Players in a bonus stay pinned to the version they started on.

Live math operations

Validate, publish, or schedule a new definition from the admin console with hot reload, automatic archiving, one-click restore, and a change log of every attempt.

RTP simulator

Multi-threaded Monte-Carlo runs on the production engine (default 100,000 spins), including what-if runs on a candidate definition before it goes live.

Validation

Command-line definition checks and 19 offline golden suites covering the engine, money contract, protocol, features, maintenance rules, and RTP windows.

04

Data

MySQL or MariaDB through Entity Framework Core. 17 migrations run automatically at startup. Every financial command is one database transaction with row locks.

TableHolds
UsersPlayers and admins, BCrypt password hash, balance, wallet revision, block and admin permissions
TransactionsEvery wallet movement with before/after balance and source
GameLogsEvery round with its full result, command type, and math version
SpinCommandsIdempotency receipts: request hash and stored response
FeatureSessionsReconnectable, version-pinned bonus state per player and game
GameStatsPer-game ledger, RTP target, and enabled flag
GameBanks · JackpotsShared payout bank and progressive jackpot pools
GameMaintenancesGlobal or per-game maintenance windows
MathChangeLogs · ScheduledMathDeploymentsMath publish history and scheduled releases
RtpSimulationRunsSaved simulator runs with settings and reports

Database constraints and a trigger keep balances in range and wallet revisions monotonic.

05

Admin console

A web console served by the game server at /admin. The console UI is in Korean. Try it with the demo account on the home page.

AreaWhat the operator can do
DashboardKPIs and measured RTP over rolling 1, 3, 6, and 12-hour windows
RealtimeLive play activity and request success, failure, and latency
GamesEnable or disable games, set RTP targets, schedule global or per-game maintenance
MathEdit, validate, publish, schedule, and restore game definitions
SimulatorRun and compare RTP simulations
PlayersSearch players, adjust balances, block accounts, grant maintenance bypass
ReportsPer-game RTP split into base game, free spins, and feature buys
RoundsSpin history with filters, round detail and replay, raw game logs
AuditMath changes, balance adjustments, and admin actions
SecurityCreate admin accounts and grant none, view, or edit per area

Permissions are carried in the admin's token and enforced on every admin API call, not only hidden in the UI.

06

Security

  • JWT authentication (HMAC-SHA256) with issuer, audience, and lifetime checks; BCrypt password hashing for players and admins
  • Server-authoritative play: the server generates the board, evaluates wins, and settles wallet, bank, and jackpots in one transaction
  • Replay protection through idempotency receipts, plus row locks and concurrency tokens on wallet and session state
  • Blocked accounts are refused at login and on every command
  • Game IDs resolve only through the loaded catalog, never as file paths; invalid definitions stop the server from starting

07

Game catalog

The 13 live titles as defined in their math files. Gamble, ante, and super-spin modes exist in the engine but are switched off in all of them.

TitleGridPaysMain featuresFeature buyMax win
Savanna Storm5×41,024 waysFree spins 8/15/20 with retrigger, ×1–×3 wilds, symbol upgrades from a collector100×
Sunstone Citadel5×450 linesFree spins 10/15/20
Velvet Fortune5×350 linesHold & win with MINI–GRAND jackpots; 6 free spins with ×5 wins
Jadeveil Temple5×3Row-anywhereChoice of 5 free-spin packages (10×2 to 3×8), shared progressive GRAND
Frostpeak Dominion5×35 linesRepeat-win free spins, adjacent-reel scatter pays, paired MAJOR/MINOR jackpots
Mischief & Gold5×325 linesHold & win with 12 respins, multiplier coins, five jackpot tiers; 12 free spins
Verdant Fang5×325 linesWilds ×2–×20, 10 free spins with retrigger, gem respin, symbol jackpots10,000×
Amberclaw Dynasty5×3243 waysHold & win with five jackpot tiers; 8 free spins100×
Sunscarab Vault5×350 linesHold & win with MINI–GRAND jackpots; 9 free spins100×
Copperfang Canyon5×320 linesFree spins 5/10/15
Crimsonwood Tales5×320 linesFree spins 8/10/12, bonus-scatter instant prizes 5/15/50×
The Animal Party5×320 linesSticky wilds in free spins, ×2/×3 wilds, random free-spin count; declared RTP 96.51%6,750×
Stormforge Legacy5×320 lines×1/×2 wilds, 8 free spins6,750×

Feature buy and max win are multiples of total bet. The default RTP target is set per game in the admin console.

08

Deployment

Server OSLinux x64 (publish script and systemd unit included)
Runtime.NET 8 (ASP.NET Core)
DatabaseMySQL or MariaDB; the account must be able to create triggers and check constraints
NetworkPlain HTTP on a configurable port (7760 by default); terminate TLS at your reverse proxy or load balancer
Game contentGame definitions in a games folder; client bundles served from the game server or any static host
Client buildUnity 6000.3.20f1; Android builds need the Android module and your signing keystore

Go-live checklist

  • Set your own JWT signing key, database credentials, and admin password
  • Turn off test credit, the empty-wallet refill, open registration, and Swagger as your integration requires
  • Restrict CORS to your domains and put rate limiting and TLS in front of the server
  • Run the service as a dedicated non-root user in the production environment

Not included

  • iOS and Windows build profiles
  • Third-party RNG or RTP certification
  • Multi-currency wallets (one virtual currency, XGC) and third-party wallet integration
  • Docker images and CI pipelines
Inquiry / Purchase