On-chain & non-custodial
The app is a window, not the game
Be precise about what you're looking at: the Telegram Mini App is a convenient interface over the smart contract — nothing more. It mirrors the chain through our read-relay and may run a second or so behind; the authoritative state always lives in the contract on Solana. If the app, our servers, and our domain all vanished tomorrow, the game would keep running: every game's state, every ticket, every vault is on-chain, and every instruction is callable by anyone, directly, without us.
That's not a slogan — it's an invariant we build against. Anything the app shows you can verify on Solscan; anything the app does you could do yourself with the public program — here's how.
Your keys, your funds
BurnBola is non-custodial. Your wallet is created and held by you (via Privy embedded wallets in Telegram — exportable to any Solana wallet app); we never hold keys and can't move your funds. Buying, exiting, selling — every action is a transaction you sign. Payouts (exits, wins, refunds, promoter shares, leaderboard prizes) go from program vaults directly to your wallet, atomically, in the transaction that triggers them. There is no balance "on the platform", no withdrawal queue, no approval step.
What the operator can and cannot do
The honest list of privileged powers, all enforced by the contract:
- Withdraw lottery revenue — only to the single treasury address hard-wired into the contract. A compromised operator key cannot redirect revenue anywhere else.
- Pause new game creation — a safety brake. Pausing cannot touch running games: they finish, exits work, winners get paid regardless.
- Nothing else. No instruction exists to change the rules of a live game, pick winners, block a player, or touch the bank/jackpot/promoter-pool vaults.
When new games are paused
Sometimes we pause new game creation — a safety brake (for an upgrade, an incident, or a quiet stretch). It's the operator power from the list above, and it's deliberately narrow:
- What stops: only starting a brand-new game.
- What keeps working — everything else: games already running finish normally, you can still buy into an open game, exit for your payout, receive your promoter & leaderboard payouts, and withdraw your balance at any time. Your funds are never locked.
While a pause is on, the app shows a yellow ticker across the top — it looks like this (hover to pause it and read):
● NEW GAMES ARE PAUSED — RUNNING GAMES, EXITS, REFERRAL & LEADERBOARD REWARDS, AND WITHDRAWALS ALL STILL WORK AS USUAL; ONLY STARTING A BRAND-NEW GAME IS ON HOLD.
The pause clears by itself the moment new games are switched back on.
NOTE
That same spot at the top of the app is also where you'll occasionally see announcements from the team — short notices about updates, events, or status. They're purely informational: an announcement never changes the rules of a game or touches your funds.
Consistency is enforced every step
The contract checks its own bookkeeping invariants (ticket counts, vault balances, phase legality) with hard assertions on every transaction — not in some debug mode. A lottery whose internal numbers silently drift is dead; ours would rather halt a transaction than let the books lie.
Built to be audited
The economic rails are deliberately simple — fixed fees, fixed splits, a handful of vaults — because every clever exception is a place for a bug to hide. The full money flow fits on one page, and the program's transactions decode into exactly those flows. Check us.