Home / Tech spec

Technical specification

What ships in the source delivery.

Measured from the current build of the platform: the Unity client, the game server, the slot engine, the database, and the admin console. Every package — from the $999 single game to the 30-game bundle — includes all of it.

At a glance

Game client
Unity 6 (6000.3), URP 2D, Addressables, Unity Localization
Build targets
Android (IL2CPP, ARM64, API 25+), WebGL, macOS
Game server
C# · ASP.NET Core 8 (.NET 8) · REST · SignalR · Swagger / OpenAPI
Database
MySQL or MariaDB via Entity Framework Core, 17 migrations
Admin console
Web console with 11 permission areas (UI in Korean)
Client languages
12 · ko en ja zh-Hans zh-Hant fr it de tr ru es pt
Source code
≈82,000 lines client C#, ≈45,000 lines server C#, ≈8,000 lines admin web UI
Tests
≈650 EditMode + ≈35 PlayMode client tests; 19 offline engine golden suites
Games
13 titles, each a JSON math definition plus an art pack

01

Game client

One Unity project runs every title. The client only animates results: reels, balance, and features are decided by the server.

EngineUnity 6000.3.20f1 · Universal Render Pipeline 17.3 (2D renderer) · uGUI · Input System
Key packagesAddressables 3.1 · Localization 1.5 · Newtonsoft JSON 3.2 · Timeline · Visual Effect Graph
Build targetsAndroid (IL2CPP, ARM64, min API 25) with a command-line signed-APK build; WebGL; macOS. A full client build can be shared on request.
Content packagingEach title is a remote Addressables group downloaded on demand; the lobby and shared UI ship in the app. The game server can host the bundles itself at /addressables.
Code layoutBoot, Core (wire models), Game (slot-style machine, reels, coin round, lobby, respin board), Net (REST client, asset loading), UI (HUD, rules pages, localization), Timeline (server-event presentation), Editor (build and art tooling)
NetworkingREST over UnityWebRequest with JWT bearer auth. Spin commands carry protocol version 2 and a fresh idempotency key; one safe retry reuses the same request bytes.
EmbeddingA slot panel entry point lets a host Unity app list the games and launch them with its own session token; an exporter packs the runtime as a DLL SDK.
Localization12 locales, a shared UI string table (165 keys), and per-title rules pages; language picker plus device-locale detection
Tests65 EditMode and 8 PlayMode test files (≈686 test cases by source count)

02

Server & API

A single ASP.NET Core 8 service hosts the game API, the SignalR hub, the admin console, and optionally the client's content bundles.

Stack.NET 8 · ASP.NET Core · EF Core (Pomelo MySQL 8.0) · JWT Bearer · BCrypt.Net · Swashbuckle
Startup checksValidates every game definition, applies database migrations, and checks pinned feature sessions; the server refuses to start on invalid data.
Background workScheduled math deployments publish at a set UTC time.
HealthGET /health

API endpoints

EndpointAccessPurpose
POST /api/auth/registerPublicCreate a player account
POST /api/auth/loginPublicSign in; returns a JWT with virtual-coin balance and revision
GET /api/gamesPublicLobby list, optionally with maintenance status
GET /api/games/{id}/configPlayerReels, symbol table, coin levels, features, math version and hashes
POST /api/games/{id}/spinPlayerCoin round, free round, or feature round
POST /api/games/{id}/commandPlayerFeature commands such as the free-spin choice
GET /api/games/{id}/sessionPlayerReconnect to an unfinished feature
GET /api/balancePlayerVirtual-coin balance and revision
/api/admin/*Admin (per-area permission)42 endpoints behind the admin console
/hubs/livePlayerSignalR hub pushing virtual-coin balance updates

Protocol guarantees

  • Idempotency keys: every command writes a durable receipt; a retry with the same key returns the stored response, a different request with the same key is rejected.
  • Session and balance revisions act as concurrency tokens, so stale or duplicated commands cannot settle twice.
  • Virtual-coin amounts are carried in integer minor units (4 decimal places); the server derives and checks the amount instead of trusting the client.
  • One canonical error body with 39 machine-readable codes and a retryable flag.
  • Each round returns an event list, a final snapshot, the next available commands, and the math version and hashes it was produced with.

Spin request

POST /api/games/{gameKey}/spin
Authorization: Bearer <jwt>
{
  "protocolVersion": 2,
  "command": "spin",
  "gameKey": "{gameKey}",
  "coinAmount": 1.0,
  "lines": 20,
  "amountMinor": 200000,
  "currency": "XGC",
  "idempotencyKey": "7f3c…",
  "sessionRevision": 41
}

Spin response (excerpt)

{
  "roundId": "…",
  "state": "base",
  "reels": [[3,7,1],[…]],
  "result": { … },
  "freeRounds": { … },
  "events": [ … ],
  "availableCommands": ["spin"],
  "balanceMinor": 998000,
  "balanceRevision": 1043,
  "mathVersion": "…",
  "mathHash": "…"
}

03

Slot engine

One data-driven engine runs every title from its JSON definition. New games are mostly new definitions and art, not new server code.

Result evaluation

Paylines, ways (fixed or variable rows), pay-anywhere, and row-anywhere evaluators, plus cascades (tumbles) and a max-multiplier cap.

Features

Free rounds with retriggers, player-choice free-round packages, respins, gem respins, sticky, multiplier and raining wilds, and feature rounds.

Feature tiers

Optional shared feature pools and fixed feature tiers, scored as multipliers.

Random numbers

Cryptographic RNG (.NET RandomNumberGenerator) in production; a seeded RNG for simulations and tests. Every round's full result is stored, so any round can be replayed in the admin console.

Math tuning

Game math is defined per title and can be tuned from the admin console. Detailed math notes are available on request under NDA.

Math definitions

Each title is three JSON parts — base game, free rounds, and logic — with SHA-256 math and definition hashes. Users in a feature round stay on the version they started.

Live math operations

Validate, publish, or schedule a new definition from the admin console with hot reload, automatic archiving, one-click restore, and a change log of every attempt.

Math simulator

Multi-threaded Monte-Carlo runs on the production engine (default 100,000 spins), including what-if runs on a candidate definition before it goes live.

Validation

Command-line definition checks and 19 offline golden suites covering the engine, virtual-coin contract, protocol, features, and maintenance rules.

04

Data

MySQL or MariaDB through Entity Framework Core. 17 migrations run automatically at startup. Every financial command is one database transaction with row locks.

TableHolds
UsersUsers and admins, BCrypt password hash, virtual-coin balance, balance revision, block and admin permissions
TransactionsEvery virtual-coin balance movement with before/after balance and source
GameLogsEvery round with its full result, command type, and math version
SpinCommandsIdempotency receipts: request hash and stored response
FeatureSessionsReconnectable, version-pinned feature-round state per user and game
GameStatsPer-game ledger and enabled flag
Virtual-coin poolsShared virtual-coin pool and feature-round pools
GameMaintenancesGlobal or per-game maintenance windows
MathChangeLogs · ScheduledMathDeploymentsMath publish history and scheduled releases
Math simulation runsSaved simulator runs with settings and reports

Database constraints and a trigger keep balances in range and balance revisions monotonic.

05

Admin console

A web console served by the game server at /admin. The console UI is in Korean. Access is available on request.

AreaWhat the admin can do
DashboardKPIs over rolling 1, 3, 6, and 12-hour windows
RealtimeLive play activity and request success, failure, and latency
GamesEnable or disable games, edit game math settings, and schedule global or per-game maintenance
MathEdit, validate, publish, schedule, and restore game definitions
SimulatorRun and compare math simulations
PlayersSearch players, adjust balances, block accounts, grant maintenance bypass
ReportsPer-game results split into base game, free rounds, and feature rounds
RoundsSpin history with filters, round detail and replay, raw game logs
AuditMath changes, balance adjustments, and admin actions
SecurityCreate admin accounts and grant none, view, or edit per area

Permissions are carried in the admin's token and enforced on every admin API call, not only hidden in the UI.

06

Security

  • JWT authentication (HMAC-SHA256) with issuer, audience, and lifetime checks; BCrypt password hashing for players and admins
  • Server-authoritative play: the server generates the board, evaluates results, and updates the virtual-coin balance in one transaction
  • Replay protection through idempotency receipts, plus row locks and concurrency tokens on balance and session state
  • Blocked accounts are refused at login and on every command
  • Game IDs resolve only through the loaded catalog, never as file paths; invalid definitions stop the server from starting

07

Game catalog

The 13 live titles as defined in their math files. Virtual coins only.

TitleGridLinesMain featuresExtra featureMax multiplier
Savanna Storm5×41,024 waysFree spins 8/15/20 with retrigger, ×1–×3 wilds, symbol upgrades from a collector100×—
Sunstone Citadel5×450 linesFree spins 10/15/20——
Velvet Fortune5×350 linesRespins with four feature tiers; 6 free rounds with ×5 multipliers——
Jadeveil Temple5×3Row-anywhereChoice of 5 free-round packages (10×2 to 3×8), shared top feature tier——
Frostpeak Dominion5×35 linesRepeat-feature free rounds, adjacent-reel scatter matches, paired feature tiers——
Mischief & Gold5×325 linesRespins with multiplier coins and five feature tiers; 12 free rounds——
Verdant Fang5×325 linesWilds ×2–×20, 10 free rounds with retrigger, gem respin—10,000×
Amberclaw Dynasty5×3243 waysRespins with five feature tiers; 8 free rounds100×—
Sunscarab Vault5×350 linesRespins with four feature tiers; 9 free rounds100×—
Copperfang Canyon5×320 linesFree spins 5/10/15——
Crimsonwood Tales5×320 linesFree rounds 8/10/12, scatter coin collect at 5/15/50×——
The Animal Party5×320 linesSticky wilds in free rounds, ×2/×3 wilds, random free-round count—6,750×
Stormforge Legacy5×320 lines×1/×2 wilds, 8 free spins—6,750×

Extra features and the max multiplier are expressed as multipliers of the coin amount used for the round. Game math is set per title in the admin console.

08

Deployment

Server OSLinux x64 (publish script and systemd unit included)
Runtime.NET 8 (ASP.NET Core)
DatabaseMySQL or MariaDB; the account must be able to create triggers and check constraints
NetworkPlain HTTP on a configurable port (7760 by default); terminate TLS at your reverse proxy or load balancer
Game contentGame definitions in a games folder; client bundles served from the game server or any static host
Client buildUnity 6000.3.20f1; Android builds need the Android module and your signing keystore

Go-live checklist

  • Set your own JWT signing key, database credentials, and admin password
  • Turn off test credit, the empty-balance refill, open registration, and Swagger as your integration requires
  • Restrict CORS to your domains and put rate limiting and TLS in front of the server
  • Run the service as a dedicated non-root user in the production environment

Not included

  • iOS and Windows build profiles
  • Third-party random-number certification
  • Ships with one virtual currency (XGC) with no cash value. Multi-currency balances and cash redemption are not included.
  • Docker images and CI pipelines
Inquiry / Purchase