Hi everyone, sorry for disappearing and lacking news, but I was working hard to implement some improvements and also with the help of @acidyo, we made a good Audit, raising some critical and medium errors for resolution.

I was focused most of the time on the mobile layout, which is turning out sensational. Much better than I had imagined, this part is fully operational and ready for you to use.

I checked a few more things here and there and I can say that it's finally ready! Whether on the browser or on your mobile phone, are you and your friends ready to wage the most epic battles the world has ever seen? :D

Audit

• The server trusts all the statistics that the client sends – full PvP cheat. It only validates Array.isArray(board) && board.length === 9 and then delivers the board directly to simulate(). The simulator reads atk, maxHp, hp, skillPower, critChance, critRate, lv, tp directly from each unit.

• All the match/pay state is only RAM: a failure burns the bets. ActiveMatches is a process-in-memory map. The server's own comment admits: "survives reboots only if there is a single Railway instance". If Railway is redeployed or the OOMs box is reset after a player has paid, but before resolution, m.payments will expire, the refund timeout will never be triggered, and the user will pay into a black hole. With real money deposit, this is a disaster for customer trust. Fix: persist payment confirmations + match Postgres status on each transition and rehydrate activeMatches on startup.

• The Paladin's Sacred Aura is applied twice in PvP mode and only once in the vs. Bot mode. This was a critical bug, after all, whoever used the paladin would have a huge advantage over their opponent.

• The Matchmaker ignored the format of pairs by bet. Two players who chose BO3 and BO7 with the same bet were matched, that is, they would be placed against each other. The first player's format was being silently selected. The fix was quite simple: e1.format === e2.format. This error is almost funny because it was one of the first things I asked Claude to implement: searching for players with the same format and bet amount.

• POST /api/migrate is not authenticated; anyone on the internet could propagate DDL+ to the production database. The fix was to apply a gate requiring "requireAdmin".

• The operator could place bets even without Hive credentials. Therefore, HIVE_GAME_ACCOUNT is not defined, and players could queue "10 HIVE" in matches that don't require payment and don't pay out prizes. Fix: reject bets greater than zero on the server side when Hive credentials are missing and hide the options on the client side via /api/version.

• /api/auth/verify accepts any 5-minute signature, validating only the "time stamp" within the memo. There was no nonce issued by the server, so a captured signature could be replayed against the API for 5 minutes. The fix applied was to issue a single nonce in /api/auth/challenge and require the memo to incorporate it.

Mobile

I finally managed to come up with a cool layout for mobile. Now we can play Horizon Forge on our phones without problems. With all the main fields visible, mainly the battlefield (3x3 grid), the recruitment tab, tents, log, and options menu.

Speaking of options, to make the game better and more fluid, when entering a battle, there will be a question about putting the screen in fullscreen. After the user accepts this, all battles will be done in fullscreen, making it much better to see all the necessary elements.

When tested via browser with DevTools, the game is already in fullscreen, so this caused a certain difference compared to the mobile version, since for now Horizon Forge is a browser game and not an app. Because it runs in a browser, you have the link bar at the top and the mobile navigation bar at the bottom (I can only test on Androids for now), and with that, the actual game area is quite reduced.

Perhaps I could add an option to the main menu, in the "CONFIG" tab, to always run the game in fullscreen; this would certainly make everything more enjoyable, both for browsing and battling. Of course, I need to think: what if the user wants to exit the browser? Will the options appear below? Will they have to keep going into CONFIG all the time? Well, there are many things to think about.

Anyway, after weeks, now we have a stable version that works and is good to play. From now on, it's about refining and improving what we can offer with the game. Adding more things, more heroes, and so on.

ATTENTION

Of course, bugs, errors, and strange things may still be present. Anything you find or suspect is out of the ordinary, please tag me in my posts or snaps and include a screenshot if possible so I can validate if it's a genuine error. If it's a real error, I might even send some $hive tokens as a reward!

So, your help will be rewarded! I don't have much to offer, but I'm keen to help everyone who is helping me!

Thank you very much and until next time, everyone!

Horizon Forge >>Discord<< | Follow on X