ARCADIA

A game economy with a real supply invariant, where the gold farmers meet a collusion detector.

Open the live chamber in the app
The animated flow, the attack replays and the deep architecture run there; this page is the reference text.

Who this serves

• Studio economy team. Design the faucets and sinks; the invariant holds the line.
• Player-run guilds. Guild treasuries as real organizations with real books.
• Marketplace operators. Player trades settle exactly once, disputes included.
• Anti-cheat and trust. Farm rings surface in the trade graph, not in forum threads.

The problem

Every large game economy eventually meets the same three horsemen: inflation from duplicated or over-fauceted currency, gold-farming rings that industrialise the loops, and a marketplace where the operator quietly holds all the books. Studios rebuild the same fragile economy tooling, game after game.

The system

ARCADIA runs a persistent world’s economy on the same rails this network uses for everything else. The game’s currency is a frame unit with a supply invariant: every faucet is a recorded mint, every sink a recorded burn, and an auditor the studio does not control verifies conservation continuously, which converts "the devs duped gold" from a rumour into a checkable claim. Player guilds are organizations with treasuries, share books and dividends; the auction house is an order book, not a database the operator edits.

At scale, the interesting part is the immune system. A farming operation spins up four hundred accounts trading in a tight ring, and the ring is exactly the kind of structure the collusion detector walks the trade graph for every day. The accounts are quarantined as a set, their flow frozen in place, and the season’s reward pool, defended by circuit breakers and velocity tracking, pays the players who actually played.

The cast and their ceilings

The flow, step by step

1. Every faucet is a recorded mint. Every sink is a recorded burn.
2. The auction house is an order book, not an editable table.
3. Guilds are organizations: treasuries, shares, dividends.
4. An auditor the studio does not control verifies conservation, continuously.

Each need, mapped to a live primitive

The attack this chamber refuses: The four-hundred-account farm

The attack. A farming operation runs four hundred accounts in a tight trading ring to industrialise the season rewards.

Why it fails. The ring is a strongly connected component in the trade graph, which the collusion detector walks daily; reward pools sit behind circuit breakers and velocity tracking, so the extraction pattern trips defenses before it drains anything.

What actually happens. The set quarantines together, flows freeze in place for review, and the season pool pays the players who played.

Deep architecture

ARCADIA deployed: the studio’s frame runs the world’s economy: recorded faucets, recorded sinks, an order-book auction house, a defended reward pool; the players and their guilds act as first-class accounts; and the auditor that verifies conservation sits outside the studio’s reach, which converts "the devs duped gold" from a rumour into a checkable claim. The trace replays one season: mint, trade, ring, quarantine, rewards.

The deployment, traced

1. The engine drops loot. Every faucet is a recorded mint; every sink is a recorded burn.
2. The world ledger carries a real supply invariant, continuously.
3. An auditor the studio does not control verifies conservation. "The devs duped gold" becomes a checkable claim.
4. The verification is public. Players can read it; so can journalists.
5. The auction house is an order book, not a database the operator edits.
6. Market makers quote inside spend policies.
7. Guilds are organizations: treasuries, share books, dividends, votes.
8. The economy director proposes a faucet change. Proposing is all it can do alone.
9. Parameters move by governance, on the record.
10. A farming operation spins up four hundred accounts trading in a tight ring: exactly the structure the collusion detector walks the trade graph for, every day.
11. The ring is quarantined as a set, its flow frozen in place, on evidence.
12. The season pool, defended by circuit breakers and velocity tracking, pays the players who actually played.

Adoption, phase by phase

Discover: The economy design, made falsifiable.

• Runs. Nothing. The faucet and sink tables of the current game, redrawn as recorded mints and burns.
• Agents. None. The economy team argues about which faucets are actually recorded today, which is the uncomfortable, productive argument.
• Integrates. Nothing. The engine and the live game stay untouched.
• Deliberately not yet. No invariant exists to check.
• Proof that gates the next phase. One patch cycle’s currency changes re-expressed as faucet and sink records, and the net supply comes out where the designers believed it was.

Pilot: A test shard with a conserved economy.

• Runs. A frame for one test shard: registry, TEG, EventStore, identity fabric on one VM.
• Agents. economy-director, one guild treasury, market makers; the auditor runs from day one, outside the team.
• Integrates. The engine mints through the recorded faucets only; the auction house replaces the shard’s trade window.
• Deliberately not yet. No real players. The collusion detector trains on staged rings.
• Proof that gates the next phase. A staged four-hundred-account ring is detected and quarantined as a set within a day, with the season pool untouched.

Production: The live world, conserved in public.

• Runs. A frame per game world or per studio. The economy tooling is the platform, not a mod.
• Agents. The full cast; guild treasuries and dividends live; circuit breakers and velocity tracking defend the pool.
• Integrates. The engine talks to the economy like any other client; the launcher’s storefront, where fiat exists at all, is purchase-only.
• Deliberately not yet. Cross-world trading. One world’s invariant proves itself first.
• Proof that gates the next phase. A season closes with the independent auditor publishing continuous conservation, and support tickets about duped gold answered with a link.

Federation: Worlds trade like registries do.

• Runs. Unchanged. World frames federate bilaterally where studios choose to.
• Agents. Guild and player reputations travel with DIDs between titles that opt in.
• Integrates. Each connected world is a signed card and a licence.
• Deliberately not yet. Redeemability of any unit for money remains the studio’s design and the studio’s regulatory question.
• Proof that gates the next phase. Two worlds exchange value through a corridor for a season with both invariants intact and both auditors public.

Sizing

One trade, and the invariant behind it

sequenceDiagram
  participant Eng as game engine
  participant TEG as faucets + sinks
  participant AH as auction house
  participant Pool as season pool
  participant ES as world ledger
  participant Aud as independent auditor
  Eng->>TEG: loot drop = recorded mint
  AH->>TEG: trade settles, fee sinks
  Pool->>TEG: rewards, breakers + velocity checked
  TEG-->>ES: every mint, burn and trade, append-only
  ES-->>Aud: conservation verified continuously
  Aud-->>Aud: published: supply delta is zero
  Note over AH: a 400-account ring is a graph shape, and the detector walks the graph daily

Topology, as declared

flowchart LR
  P["players + bots"] -->|"earn via recorded faucets"| TEG["frame unit economy<br/>delta = 0 audited"]
  TEG -->|"order book trades"| AH["AGORA venue<br/>auction house"]
  AH -->|"dividends"| ORG["guild organizations<br/>treasuries + shares"]
  CD["collusion detector<br/>Tarjan SCC, daily"] -.->|"ring quarantine"| TEG
  TEG --> ES[("economy ledger")]
  AUD["independent auditor"] --> ES

Standing it up

• Infrastructure. A frame per game world, or per studio. The economy tooling is the platform.
• Agents. 4 to 6 roles; the game server talks to them like any other client.
• Integration. Gameplay stays in the engine. The protocol carries the economy underneath it.

Runs beside what you already have

• The game engine and inventory services. Gameplay stays in the engine. The economy underneath gains a supply invariant.
• Player account systems. Accounts map to agent identities. Bans propagate as revocations.
• Marketplace and trading services. Existing trade UIs call the settlement rail instead of a mutable database.

A full sovereign frame is nine containers and boots in about two minutes, on anything from a Raspberry Pi to a rack. That is cheap enough to run the whole system in parallel with the legacy stack: the old system keeps running, real work mirrors onto the rails, and you compare ledgers until the evidence settles the argument. Nothing is ripped out.

Planned: a public proxy library. Free, ready-made connectors for the systems above and whatever else a merge needs, so the bridge is an import, not an integration project.

What this does not claim

• ARCADIA is an in-game economy on network units. Whether any unit is redeemable for money is the studio’s design and the studio’s regulatory question.
• The fiat lane, where enabled at all, is purchase-only with no withdrawal path by design.