Tested
What we tested before the realm went live and what came out of it: 357 of 357 checks on the launch build, the bug the tests caught, load tests with hundreds of bots, a full rehearsal on the real server, security reviews, and the simulations behind the economy.
How we test
Every feature that touches the world or the money ships with a suite: a script that logs real game clients into a copy of the realm (built on the same protocol library as the browser client), plays the feature end to end, tries to break it, and then checks the books. The money checks don't trust the game's own say-so: every character's Mithril has to equal its last ledger row, and every mail, trade and purchase has to be matched on both sides.
The suites run against the launch binary with the launch settings, on a separate test realm, never on the realm players use.
The launch build: 357 of 357
These ran on the exact server build that went live, between 13 October 01:13 and 13:41:
| Suite | What it proves | Result |
|---|---|---|
| Security | Money, item and level commands refused in game and logged. Unsettled Mithril can't be moved or withdrawn. Withdrawal spacing and cooldown hold. Login waits for Mithril still settling. Anticheat: honest walking, mounts, summons, jumps, Charge, Blink and 3 to 8 second freezes are not flagged; forged double speed, 60-yard jumps, flying, water walking, teleports and ignored slows are kicked. | 44/44 |
| The Cartel's First Job | Marker drops in all six starting areas; the forced start roots and releases correctly; Founder #1 paid 160,000 once; the level-10 part locked until 20; double turn-ins and relogs pay nothing; the standard purse after the founder spots; 8 simultaneous claims for 2 spots give exactly #1 and #2. | 66/66 |
| The Big Score | All six steps for both factions with their level gates; the disguise, the explosion, the escort; a private vault run nobody else can help with or disrupt; race places under 8 simultaneous claims; the 20,000,000 and 2,000,000 prizes paid exactly once, even across a crash; an 11th finisher gets no prize; the Hall of Fame plaque. | 72/72 |
| Travel | The 30-minute Hearthstone; +30% pace out of combat (9.1, 11.83, 14.56 and 18.2 yards a second) and not in combat or dungeons; the mule quest's gates and its exact 250,000 Mithril charge; long runs at full speed with no anticheat flag, and a 2.2x speed hack kicked. | 29/29 |
| Cartel Courier | Buying the mailbox, a 500,000 Mithril sink; non-owners and forged mailboxes get nothing; take, send, return and delete mail anywhere; refused in combat, dead or in dungeons; every purse equals its last ledger row, every mail debit matched. | 49/49 |
| Trade Prince Mithrix | Menus by level and faction; a refusal charges nothing; flight unlocks saved per continent; all 22 rare goods at their prices, with stock and restock; prices up to 25,000,000 intact; nothing sells back for more than 5% of its price; boosts charged as sinks. | 63/63 |
| Withdraw page | The Exchange's 1, 10, 25, 50 and 100% amounts are exact; "Send 10%" withdraws exactly what it says; the 15-minute cooldown refuses a second. | 4/4 |
| Launch patches | Launch respawns; the master-loot dupe refused; island and test-map guards; new-account spam gates; party loot; wall climbing kicked; mail, trade, vendor and stack-split races with disconnects at 50 to 300 ms and instant relogs: never a duplicate, ledger chains intact. | 30/30 |
| Total | 357/357 |
What the tests caught
The runs before that weren't all green, which is the point of running them:
- A real ledger bug. The first full check of the launch candidate scored 321 of 327. Five were test-script and timing issues; one was real: the two money rows of one letter could reach the ledger in swapped order. Each character's rows now commit in their own transaction. Fixed before launch, then the whole set ran again: 327 of 327, plus the patches suite.
- A real item dupe. Group master loot could duplicate an item (vanilla servers inherit this from their upstream). The patches suite reproduces it on the old build and shows the new one refusing it.
- An honest player flagged as a cheater. A 3-second freeze after a loading screen looked like a teleport to the anticheat. The realm now tolerates the way a browser client catches up after a freeze; we measured the real client sending at most 6.6 yards per packet after 6 to 15 second freezes.
Load
| Test | Result |
|---|---|
| 300 bots in one starting area, launch build and settings | 0 disconnects. World update p50 51 ms, p99 52 ms, worst 84 ms, nothing over 100 ms. The server used 34% of one CPU core and 1.3 GB of memory. |
| 200 bots through the relay, like browser players | 0 failures, 0 disconnects. Ping p50 0.9 ms; chat p50 36 ms; others' moves seen p50 128 ms; logins 165 to 180 ms p50 during a storm of 50 a second. About 5.5 KB a second per player. |
| 250 simulated players on the Mithril bridge | Every coin settled in p50 1.9 s and p95 4.5 s. The ceiling with one batch in flight is about 230 to 250 active players. |
The bot runs were on our test realm, not the live server; the live server is the same build on a machine with more headroom. The first 300-bot attempt failed in an instructive way: brand-new characters are rooted until they accept their first quest, so 205 walking bots were kicked for moving while rooted. The rerun used characters that had already started.
The real server, before anyone played on it
Before the move, the whole stack ran on the production server under a temporary address, with a copy of the live databases, and a headless Chrome played it end to end: sign-in, creating a Human and an Orc, the forced start, Mithrix's menu, buying the Courier and a continent unlock, the mailbox from the minimap, the map reveal, the withdraw window, the addons. The measurements from that run:
| Cold page to the login screen | 7.3 s |
| Client download and start | 1.2 s and 2.9 s |
| Enter World, Northshire | 9.1 s the first time, 5.3 to 6.2 s after |
| World update | p50 50 ms, p99 51 ms |
| Database copy and restore | 16 s; the server window, with 25 SQL checks, 17 s |
| Reboot to everything up | 31 s |
The move itself took 10 minutes. Afterwards every character, account and ledger row matched, and the reconciliation between the game and the chain reported zero drift.
Money settlement
| Time | |
|---|---|
| A batch of money events confirmed | 0.7 to 1.4 s |
| A withdrawal confirmed | about 1 s |
| A trade in game, both sides in one transaction | about 1.2 s from the trade to settled |
| Opening a wallet's game vault, once | 1 to 2 s |
The bridge was migrated three times and the token re-created once during testing, and the realm moved servers; after each, every character was reconciled against its vault: no drift.
Code tests
| Part | Tests |
|---|---|
| The economy program | 46 integration tests in a simulated Solana runtime, unit and SDK tests, an end-to-end run on a local Solana validator with players that hold no SOL at all, and a rehearsal of the deploy steps |
| The Mithril bridge | 62 passing |
| The web services (web server, relay, wallet sign-in) | 97 passing, including security headers and network limits |
| Client features for the Exchange, deposits, swaps and wallets | 124 passing |
| The client's protocol, sound, file formats and world | 255, 122, 475 and 559 |
| The whole client workspace | 8,069 test functions, upstream's included |
| The economy simulator | money conserved on every simulated day, determinism, caps |
Security reviews
- A pre-launch checklist of the money paths, keys and accounts (9 October).
- A white-box penetration test of the realm, the bridge, the program and the web services, by people who could read all the code (10 and 11 October). Two urgent fixes went live the same day.
- A launch-patch pass on dupes, crashes, world exploits and spam (12 and 13 October), which found the master-loot dupe.
- An exploit register of 113 entries across 12 areas. By 13 October, 53 were closed with evidence, 36 fixed and waiting for the launch build (which carries them), 6 open, 9 waiting on a product decision and 8 being watched.
A few of the closed ones, in plain words:
- Spending Mithril while it's being withdrawn is impossible: the debit, its ledger row and the save are one database transaction. Tested with purchases and withdrawals 0 to 500 ms apart, in both orders.
- A withdrawal can't be paid twice or sent anywhere but the player's own wallet.
- Malformed amounts at the Exchange (negative numbers, "1e9", 20 digits, an 8,800-byte string) are all refused.
- A test menu that could create Mithril was reachable by a low staff level. It's switched off for everyone.
- Anyone could have locked every player out of logging in through the shared relay address. Fixed.
- Names on this website can't inject scripts, and the bridge's admin routes aren't reachable from outside.
Anything still open is tracked privately and closed before launch, and Attacks and defences lists what's covered. Before mainnet there's a 22-point launch gate: the program's values read back from the chain, multisig and hardware keys, hourly flow caps, a fresh character database, no staff accounts, monitoring with alerts, and a real-client anticheat session.
Simulations
The economy was designed in simulation before a single coin moved:
| Study | What it showed |
|---|---|
| The policy simulator: agents levelling, raiding, crafting, hoarding, quitting and botting, calibrated on this realm's database, about 600 runs over 3 years | Bots take 79% of the money under plain mint-on-loot. A per-wallet daily allowance keeps honest players at full vanilla pay while cutting each bot to a fifth. Players who quit, not hoarders, are the biggest hidden drain. |
| The market layer: players, bots, a trading pool, outside buyers and shocks, 142 one-year runs | The realm's daily budget, not the per-wallet allowance, is what paces payouts at scale. The market cap follows outside buying, which is why the Cartel sells things worth buying MITH for, and why the realm fights bots at sign-in. |
| The launch purse | Bots farm a welcome bonus only if it's worth more than a fake account costs them, which is why the big Founders' purse is limited to the first 300 wallets. |
| The mainnet split: vault versus pool, 50 to 3,000 players, 3 years | Every split pays all loot in full up to a few hundred players; the split mainly sets the launch price. See Tokenomics. |
| Launch boosts and burning | Higher drops at launch mostly mean more Mithril sold early. Burning everything spent at the Cartel lifts the price but starves loot; burning it only while the Vault can spare it (the Cartel burn) destroyed about 15% of all MITH at a few hundred players with loot still paid at 92 to 100%. |
Next on the test list
- A full bot fleet on the live server itself (the 300-bot runs used the same build on our test realm).
- Knockbacks, taxi flights and boats under the anticheat.
- Safari, as its WebGPU support matures, and Firefox beyond Windows.
- Mainnet itself: the token launches with the realm, after the launch gate above.