BETA
SECURITY POLICY LEGAL
NETWORK — SIGNER — POOLS — READ —
READING

LEGAL · SECURITY

Security policy

LAST UPDATED 2026-10-01 · REFERENCED BY /.WELL-KNOWN/SECURITY.TXT

If you find a vulnerability in the Site, the signing service or a pool, tell us before you tell anyone else, and we will fix it and credit you. Write to hello@shyguy.studio. Machine-readable contact details are at /.well-known/security.txt.

What runs, so you know what to test

  • The Site: static files on Vercel. No accounts, no cookies, no analytics. It asks a wallet to sign only transactions the signing service built, after showing their amounts.
  • The signing service: a Cloudflare Worker (playset-signer-mainnet.see21289.workers.dev; devnet test pools at playset-signer-devnet). It reads the chain, prices quotes on each pool's line, and signs its half with a hot key that holds only capped unsold units and the sell-back float.
  • On chain: Metaplex Core (wrappers, one collection per pool), MPL-Hybrid (the escrow that swaps 100 units for a wrapper), and SPL Token (units). Playset has no program of its own.
  • Every response carries a strict Content-Security-Policy (scripts from this origin only; connections only to the signing service and the Solana RPC), HSTS with preload, X-Frame-Options: DENY, and cross-origin isolation headers. The domain publishes SPF -all, a DMARC reject policy and a null MX.

In scope

  • Any way to get units that nothing backs: more units in buyers' hands than 100 × the slabs in a pool, or units leaving the signer beyond what a quote stated.
  • Any way to make the signing service sign something other than what its quote says — a different amount, recipient, or instruction — or to spend its SOL or units outside a quote.
  • Any way to take a slab out of a wrapper you don't own, or to stop a wrapper's owner taking theirs out.
  • Any way to get value for an empty wrapper, or to take a wrapper from the escrow for less than 100 units.
  • The Site: content injection, a way to make it ask a wallet to sign something it didn't show, a way to show a number the chain or the quote doesn't say, a header or policy bypass.

Out of scope

  • Anything that needs the operator's own keys, physical access, or social engineering of Shyguy LLC.
  • Third parties we depend on: Solana, Metaplex's programs, Cloudflare, Vercel, Helius, Google Fonts, wallets, explorers, Collector Crypt and its tokens. Report those to them.
  • Devnet test cards and pools. Nothing on devnet has value and it may be reset at any time — but a flaw found on devnet that would work on mainnet is in scope.
  • Denial of service, rate-limit findings against the public RPC, and reports from automated scanners with no demonstrated impact.

How to report

Email the details — what, where, how to reproduce, and what you think the impact is. Encrypt if you like; if you need a key, ask and we will send one. We will acknowledge within three business days and keep you informed. Please give us a reasonable time to fix before publishing, do not access, modify or destroy data that is not yours, and do not test against wallets that are not yours.

What we promise

If you follow this policy, we will not pursue legal action against you for your research, we will work with you on a fix and a disclosure timeline, and we will credit you publicly if you want to be credited. There is no bounty programme yet; when there is, it will be announced here.

—POOLS OPEN
—SLABS IN POOLS
—UNITS HELD BY BUYERS
2%FEE TO BUY OR SELL
MANUAL // PAGE 01 OF 07 // ONLINE
PAGE 01 · THE POOL

One pool per character, set and grade.

A playset holds every printing of one character from one expansion at one grade from one grader.
SPEC PLATE // READ FROM THE CHAIN // ONLINE

WHAT RUNS WHERE.

Playset has no program of its own. Slabs, wrappers and the escrow run on Metaplex's audited, deployed programs; prices come from a small signing service whose every trade is a public Solana transaction. Your wallet signs only what the page showed you first.

Wrappers
Metaplex Core assets, one collection per pool. Each wrapper has its own wallet (Core's asset signer) that holds the slab's token — a Collector Crypt Core asset or pNFT.
Escrow
MPL-Hybrid. 100 units take a wrapper out of the pool; an empty wrapper buys nothing back.
Signer
— prices each trade on the line and signs its half. It holds unsold units — never more than a capped amount — and the SOL that pays for sell-backs. Nothing else.
Line
p(s) = p₀ · (1 + s / k), where s counts every unit sold, net of sell-backs — including the units a slab retires when it leaves, so a slab leaving moves nothing. With k = 100 the price doubles across one slab's units. Selling back pays the line's value at that point.
Depositors
the depositor of the j-th slab to leave is paid the line's value from (j − 1)·100 to j·100, by the signer, with a memo playset release <pool> j=<j>. The signer refuses any payout or sell-back that would leave it unable to buy back every unit buyers hold.
Fees
2% on buys and on sell-backs, a separate line in the transaction; 0.01 SOL to take a whole slab, plus about 0.005 SOL to Metaplex; 2.5% royalty if a slab is resold on a marketplace. Taking the card out, consigning a slab and depositor payments: free.
The rule
units held by buyers never exceed 100 × the slabs in the pool. The signer checks it on every quote and refuses anything that would break it.
The card out
the wrapper's owner moves the card to their own wallet with Core's execute and burns the empty wrapper in the same transaction. No Playset signature is involved, so none can be withheld.