On-chain & non-custodial

The app is a window, not the game

Be precise about what you're looking at: the Telegram Mini App is a convenient interface over the smart contract — nothing more. It mirrors the chain through our read-relay and may run a second or so behind; the authoritative state always lives in the contract on Solana. If the app, our servers, and our domain all vanished tomorrow, the game would keep running: every game's state, every ticket, every vault is on-chain, and every instruction is callable by anyone, directly, without us.

That's not a slogan — it's an invariant we build against. Anything the app shows you can verify on Solscan; anything the app does you could do yourself with the public program — here's how.

Your keys, your funds

BurnBola is non-custodial. Your wallet is created and held by you (via Privy embedded wallets in Telegram — exportable to any Solana wallet app); we never hold keys and can't move your funds. Buying, exiting, claiming — every action is a transaction you sign. Payouts (exits, wins, refunds, referral claims) go from program vaults directly to your wallet, atomically, in the same transaction that triggers them. There is no balance "on the platform", no withdrawal queue, no approval step.

What the operator can and cannot do

The honest list of privileged powers, all enforced by the contract:

• Withdraw lottery revenue — only to the single treasury address hard-wired into the contract. A compromised operator key cannot redirect revenue anywhere else.
• Pause new game creation — a safety brake. Pausing cannot touch running games: they finish, exits work, winners get paid regardless.
• Nothing else. No instruction exists to change the rules of a live game, pick winners, block a player, or touch the bank/jackpot/referral vaults.

Consistency is enforced every step

The contract checks its own bookkeeping invariants (ticket counts, vault balances, phase legality) with hard assertions on every transaction — not in some debug mode. A lottery whose internal numbers silently drift is dead; ours would rather halt a transaction than let the books lie.

Built to be audited

The economic rails are deliberately simple — fixed fees, fixed splits, a handful of vaults — because every clever exception is a place for a bug to hide. The full money flow fits on one page, and the program's transactions decode into exactly those flows. Check us.