# Leveraged-Chip Blackjack Desk (TURBO BLACKJACK)

> **Status: the desk is operating on mainnet.** TURBO BLACKJACK opened on
> 22 August 2026 and is served from the arcade at play.netnet.capital.
> Contract addresses are published on
> [Official Channels](/official-channels) and nowhere else.
> **Participation is restricted to persons 18 years of age or older.**
> Dollar figures on this page are the deployed parameters, quoted at the
> market price of NVDA where so labeled, and never a promise.

TURBO BLACKJACK is a six-deck blackjack table whose chips are TURBO cards.
A chip is not a token of the cabinet's own making and it is not a casino
chip. It is one Knock-Out Note on NVDA, the tokenized NVIDIA equity that
trades on Robinhood Chain, bought from the [Long-Dated Desk](/turbo) at the
printed formula and held in the player's own wallet as an ordinary ERC-1155.
Its dollar value is the live value of a leveraged NVIDIA position, and it
moves while the hand is being dealt. Winning a hand pays more chips, which
means more NVIDIA exposure. Standing up returns the chips to the wallet,
where they can be cashed out at the Long-Dated Desk for what the formula says
they are worth.

**Read this before anything else on the page. If NVDA touches the chip's
financing level K, every chip in the game is worth zero at the same instant.**
The players' stacks and the escrowed sessions die together, there is no
residual, and there is nothing to claim afterwards. The table series is a
dedicated 5x listing whose K sits **20% below the market price of NVDA at the
time it is listed**, which is a far wider gap than the 4% on the Long-Dated
Desk's 25x board, but it is a real line and it can be reached. A chip is a
dying position, not an inventory item.

This game is not even-money, and the documentation says so first. **Two
separate numbers are printed and neither is folded into the other.** The rule
set carries a house edge of **0.426%** against basic strategy, measured over
40 million simulated hands. The table takes a **100 basis point rake at the
door** on the chips deposited, and takes **nothing per hand**. This is the
SPACEX INVADERS and Superstore honesty model, not COINflip's: COINflip's coins
are exactly fair and its fee is the whole edge, and that sentence is false
about this table, so it does not appear here.

The consumer application speaks plain English by design, and its rules
panel carries the edge disclosure, the fee disclosure and the knock
disclosure in full and link here. This page is the controlling description of
the mechanics.

## The chip

One chip is one TURBO card of a single designated series, called the table
series. All chips at the table share one ERC-1155 id, so a stack of seven
chips is seven identical claims and paying a player is a transfer of a count.

* **What it is.** A CALL card on NVDA at **5x leverage**, meaning its
  financing level K is set at listing to 20% below the mark. Its value is
  **units per card times the amount by which the NVDA mark exceeds K**, read
  live from the Long-Dated Desk against the same public Chainlink mark that
  desk quotes from.
* **What it costs.** The series is sized so that a chip is worth about **one
  dollar**. Because the Long-Dated Desk charges 5% of the premium to open and
  1% over the formula on a buy, roughly **$100 buys about 94 chips**.
* **What the table counts in.** Bets, payouts, the session cap and the
  coverage reservation are all denominated in whole chips. Dollars are a
  display column. Chips are indivisible and there is no rounding anywhere in
  the settlement path.
* **The value moves while you play.** A stack that was worth $94 when you sat
  down is worth whatever NVDA says it is worth when you stand up, and at 5x a
  1% move in the stock is roughly a 5% move in the stack. The felt carries a
  permanent readout of how far NVDA has to fall before the chips are worth
  zero.

### The knock, stated plainly

If the NVDA mark touches K, the table series knocks out. It is worth zero at
that moment, it pays nothing, and it never comes back, exactly as described
under [Long-Dated Desk (TURBO)](/turbo). For this cabinet that means:

* Every chip held by every player is worth zero simultaneously.
* Every chip escrowed in an open session is worth zero simultaneously.
* **There is no residual and nothing to claim.** Open sessions become
  unplayable and settle to nothing, because nothing is what the chips are
  worth.
* The table closes. Every entry point reads the series state on-chain and
  refuses on anything but `OPEN`. A knocked card stays transferable and stays
  worthless, so state is checked and never assumed.

This is not a defect to be engineered away. It is what a leveraged chip is.
It is handled by disclosure and by series selection, in that order. A 20%
barrier is a much larger move than a typical NVDA session, roughly eight
standard deviations of a normal day, which is why the table series is a
dedicated 5x listing rather than one of the 25x cards on the Long-Dated Desk's
board, where K sits 4% away. It is not a guarantee, and nothing on this page
should be read as one.

### The three ways a series can end are not the same

A knock is the only ending that pays nothing. A series can leave the `OPEN`
state three ways, and the felt and the application never conflate them,
because telling a player their money is gone when the desk is still holding a
claim for them is the worst direction to be wrong in.

| State | What the holder gets | Cause |
|---|---|---|
| Knocked | **Nothing.** All or nothing at the barrier. | NVDA touched K |
| Expired | The settlement value at the settle mark, paid by the holder's own `claimExpiry` at the Long-Dated Desk | The card's tenor ran out |
| Void | The premium the holder paid, refunded pro rata by the holder's own `refund` at the Long-Dated Desk | A corporate action or a bricked feed |

`claimExpiry` and `refund` are the Long-Dated Desk's functions, and they are
the holder's to call against their own wallet. When a series expires or voids,
the cabinet's job is to return the cards and say plainly what to do with them,
not to price anything. A void is strictly worse for a winning holder than an
expiry, because a void refunds the premium paid while an expiry settles at the
mark, so a stack that appreciated keeps that gain on an expiry and loses it on
a void.

### Corporate actions set the table's tenor

Rialto's tokenized equities carry a display multiplier, and a dividend changes
it. This is not hypothetical. NVDA pays a dividend every quarter, and a
dividend that drifts the multiplier is exactly the kind of event that voids a
series. The Long-Dated Desk handles it deliberately: it snapshots the
multiplier per series and fail-closes buying, cashing out and settling on any
drift, runs a grace clock, then voids the series. It does not silently
misprice.

For this table that has two consequences. During the drift window nobody can
buy chips and the keeper cannot rebalance the float, but **players can still
stand up**, because the exit pays from the desk's own card pool and calls the
Long-Dated Desk not at all. After the grace clock the series voids and the
table is dead.

Because the house bankroll is itself cards (see below), a void is a soft event
rather than a wipe. A void refunds the premium paid to every holder, the
house's float cards included, so a dividend that slips through hands the float
back at premium and the table simply reopens on a fresh series. The loss is
the difference between premium and mark on live positions, not the bankroll.
Even so, a mid-session void is a poor experience, so **the table series is
listed to expire before the next ex-dividend date.** The roll calendar is
driven by the dividend calendar. Missing a roll does not lose the money, but it
turns a clean settlement into a premium refund, so the roll is a dated
operational commitment in the launch runbook.

### You buy your own chips

**The player calls the Long-Dated Desk's `buy` from their own wallet. The
cabinet never buys chips on a player's behalf.** This is not a convenience
decision, it is the difference between two fee outcomes.

The Long-Dated Desk charges 5% of net profit when a card is closed, computed
against what the closing wallet actually paid the desk. A card that arrived by
transfer carries a cost basis of zero there, so its whole proceeds count as
profit. If the cabinet bought a player's chips and transferred them across,
the basis would sit with the cabinet and the player would pay a flat 5% of the
full value of every chip they ever cashed out, instead of 5% of their real
profit. So the buy-in is two steps by design, presented as such: buy the chips
from the Long-Dated Desk, then deposit them at the table.

The corollary is disclosed rather than left for the exit: **chips won above
the number you bought carry no basis**, so cashing those out at the Long-Dated
Desk pays 5% of their full value. That is the Long-Dated Desk's performance
fee working exactly as documented, and the cabinet states it up front.

## The table

The rules are Vegas-liberal and deliberately so. The cut is taken at the door
instead of being buried in the rules.

| Rule | Setting |
|---|---|
| Decks | 6 |
| Dealer on soft 17 | Stands |
| Blackjack pays | 3:2 |
| Double | Any first two cards |
| Double after split | Allowed |
| Split | To 4 hands |
| Split aces | Once, one card each, no blackjack, no resplit |
| Surrender | Not offered |
| Insurance | Not offered |
| Dealer peek on ace or ten | Yes |
| Bets | Even numbers of chips, minimum 2 |
| Shoe penetration | 75%, the cut card after 234 of 312 cards |

**Bets are even because chips are indivisible and 3:2 has to pay exactly.**
Rounding a 3:2 payout down on an odd bet is the same trick as paying 6:5, and
rounding it up would pay 2:1 on a one-chip blackjack, which at a 4.75% natural
rate is worth roughly 2.4% and turns the whole table player-favourable. Even
bets make the payout exact in whole chips, which is why the effective table
minimum is two chips.

**Insurance is not offered** because it is a materially worse bet than the
game around it, and offering it would mean printing a second and much worse
number beside the first.

### The edge on the rules

The house edge against basic strategy under this rule set is **0.426% of the
initial bet**. It was measured, not assumed: 40 million simulated hands across
seven independent runs, standard error 0.018%, in
`packages/blackjack-engine/src/edge.test.ts`. The engine asserts on every test
run that the measured edge falls inside a printed band, the same discipline
the SPACEX INVADERS ladder gets from its expected-value assertion at
deployment. That assertion is what stops the rules being quietly re-marked
worse than this page reads. **It is not a claim that the game is even-money,
because it is not.**

Basic strategy is the reference. A player who deviates from it faces a larger
edge, and how much larger is up to them.

## The rake, and the costs that are not ours

**The table takes 100 basis points of the chips deposited, once, at sit-down.**
It is withheld from the deposit, rounded **up** to the whole chip, and split
50/50 between the Manager and the NetNet RWA Sleeve described under
[Real World Bonds](/rwa-desk), the standard split across the fund's desks,
with neither half zeroable.

**Nothing is taken per hand.** There is no rake on the pot, no fee on a win
and no charge to sit. Once the stack is on the felt, the only cost of playing
is the 0.426% rule edge.

Rounding up rather than down because a rake that floors to zero is not a rake.
At a one-dollar chip a $100 buy-in is about 94 chips, and 1% of 94 is 0.94,
which floors to nothing. Rounded up it is one chip, an effective 1.06%. The
overshoot is bounded by a single chip and shrinks as the stack grows.

There is no single combined percentage on this page, and the reason is worth
one sentence: the rake is charged once on the stack while the rule edge
accrues per hand on volume, so a player who plays ten hands and a player who
plays five hundred pay very different totals from the same buy-in. Both
numbers are printed separately because only the player knows which of those
they are.

**Two other costs a player pays belong to the Long-Dated Desk, not to this
cabinet**, and the buy-in screen labels them as such:

* **5% of the premium to open, plus the 1% buy markup**, charged by the
  Long-Dated Desk when the player buys chips. This is why $100 buys about 94
  chips rather than 100.
* **5% of net profit on a winning close**, charged by the Long-Dated Desk when
  the player eventually cashes chips back out, and a flat 5% of full value on
  chips that carry no basis because they were won rather than bought.

The cabinet does not re-charge either of them and does not receive them. Its
own charge is the 100 basis points at the door and nothing else.

## The sealed shoe

This is the design decision that makes the cabinet playable, and it is a
deliberate departure from every other game on the floor. Every other cabinet
names a future round of the public [drand](https://drand.love) beacon, waits
about fifteen seconds, and reveals. Blackjack cannot be built that way, and
the reason is the interesting part.

### Why a public beacon alone cannot deal blackjack

A shoe is dealt over many hands, and a player who knows the order of the
undealt cards has an unbounded edge. So a shoe has to be two things at once:
**fixed**, so the house cannot change it mid-shoe, and **hidden**, so the
player cannot read ahead.

**drand is public.** That is the entire point of it, and it is why every other
cabinet on the floor can use it directly. But any shoe derived from a
published beacon is readable by everyone the moment the beacon publishes. The
problem is not that the beacon is slow. A beacon-derived shoe is a published
deck, at any speed.

Nor does one beacon per card work. A six-deck shoe is 312 cards, rounds are
about fifteen seconds apart, and that is over an hour of waiting for a shoe
the player would still only learn one card at a time.

### Why a server seed alone is not enough either

The standard provably-fair casino publishes a hash of a server seed, plays the
shoe, then reveals the seed. The commitment binds one seed, which does stop
the house changing its mind halfway through. It does **not** stop the house
choosing which seed to commit to in the first place. Nothing in that scheme
prevents an operator from generating a million candidate secrets offline,
dealing out the shoe each one produces, and committing the one that is most
house-favourable. It is a small effect and it is a real one, and this floor
does not ship small and real.

### The hybrid

The shoe seed is built from three independent contributions, and **all four of
its inputs are fixed before the drand round publishes**:

```
at shoe open
  houseSecret   = 32 random bytes held by the house
  houseCommit   = keccak256(houseSecret)                       published
  round         = a drand round due about 15 seconds from now  published
  clientEntropy = the player's seed for this shoe              published
  shoeId        = keccak256(sessionId, shoeIndex)              derived, not chosen

once drand publishes that round
  sig  = the round's signature, BLS-verified on chain
  seed = keccak256(sig || houseSecret || clientEntropy || shoeId)

at shoe close
  houseSecret is revealed, and anyone can re-derive the seed and every card
```

Each contribution buys one specific property, and none of them is decoration:

* **The drand signature stops the house grinding.** The house commits to its
  secret before the round it will be mixed with exists. A threshold of
  independent drand nodes must jointly sign a round before it exists, so no
  amount of offline searching helps: whatever the house commits to gets
  scrambled by a value nobody has yet.
* **The house secret stops the player reading the shoe.** Without it the
  published beacon would be a published deck.
* **The client entropy stops the house dealing a chosen player a chosen
  shoe.** It defaults to a value derived from the player's address, the
  session and the shoe number, which neither side can steer, and a player who
  wants to may supply their own bytes instead.

**The ordering is the whole security argument, so it is a rule rather than a
convention: all four inputs are fixed before the named round publishes.** In
particular the client entropy is committed at sit-down for the first shoe, and
at the previous shoe's open for every shoe after that. It is never accepted
after the signature is public, because at that point the player becomes the
one who can grind.

### The commitment is anchored on chain, before its round

An earlier version of this design described these properties as if they were
already enforced. They were not, and an adversarial audit found three ways the
house could have cheated a shoe that still verified as honest. Each has a fix,
and the fixes are what make the guarantees above true rather than aspirational.

* **The shoe id is derived, never supplied.** It is `keccak256` of the session
  and the shoe number, one value used identically by the seed and the
  commitment. Nothing the house passes in is free, so there is no hidden
  parameter left to grind after the signature publishes. The seed has no input
  the commitment does not bind.
* **The commitment predates its beacon.** The desk records each shoe's house
  commitment and named round on-chain before that round publishes, and rejects
  a round that is already registered at commit time and a reveal whose round
  turns out to have published before the commitment. A commitment that cannot
  be proven to predate its beacon is refused. This is the same fail-closed
  timestamp discipline COINflip uses, and here it is on-chain rather than in a
  log the house writes itself.
* **The order of pipelined shoes is fixed by the on-chain record.** The next
  shoe's commitment is anchored while the current shoe is still in play, so
  which shoe comes next is not a choice the house makes after seeing the
  signature. It cannot deal whichever of two honest shoes it prefers.

The result is that the provably-fair claim is now enforced on chain rather
than promised in prose. It is still scoped to the randomness only, never to
the money.

### The shoe is a permutation, not a shuffle

The 312 cards are not laid out by shuffling an array. The shoe is a keyed
pseudo-random permutation, a small Feistel network over the numbers 0 to 1023,
with values of 312 or more discarded and re-run until they land in range.
Discarding out-of-range values from a bijection leaves a bijection, so the
result is a genuine permutation of a real six-deck shoe: exactly 24 cards of
each rank, exactly six of each individual card, every card appearing once.

The practical benefit is that the card at any position can be computed on its
own, for a handful of hashes, without deriving the other 311. The engine tests
prove the permutation property over many random seeds and prove the Feistel
round is a bijection by exhausting all 1024 inputs.

### The wait, and where it goes

**There is no wait per hand.** Once the seed exists the entire shoe is
determined, so hit, stand, double and split resolve instantly and locally. The
beacon is consulted once per shoe, not once per hand.

**There is no wait per shoe either, after the first.** While a player is
playing one shoe, the cabinet has already committed the next one: its house
secret, its client entropy, and a drand round that publishes within seconds.
By the time the cut card appears, the next seed has existed for many minutes,
so the reshuffle is instant and the finished shoe's secret is revealed at the
same moment.

The one remaining wait, at sit-down, runs concurrently with the deposit
transaction, which takes about that long to confirm anyway. The boot screen
shows the real countdown and the real round number. The wait is never faked.

### What a player can check, and when

* **During the shoe.** The house commitment, the named drand round, the client
  entropy, and a running hash-chained log of every hand, all displayed live in
  a verification drawer.
* **At shoe close.** The revealed house secret. Anyone can re-derive the seed,
  expand the permutation, and replay every hand dealt from that shoe. The
  reveal is bound to the hand log, so a single altered card or a payout that
  does not match the cards fails verification rather than passing quietly.
* **Afterwards, indefinitely.** The reveal is published in the session log and
  the commitment is on-chain, so checking a shoe does not depend on the
  cabinet still being up, or on the fund's cooperation.

### Counting works, and we say so

A real six-deck shoe with a real cut card is countable. At a 0.426% base edge,
a competent counter has a positive expectation against this table. That is
disclosed here rather than defended against, because the usual defence is a
continuous shuffling machine, and a continuously shuffled shoe cannot be
sealed, committed and revealed. It would cost every player the verification
story in order to stop a few of them.

What actually bounds a counter is not the penetration and not a backing-off
rule. The audit measured both. Pulling the cut card in does not change a
well-bankrolled counter's edge, it only hurts an undercapitalised one, so this
page does not repeat the old claim that penetration is the lever. What binds a
counter is the **four-hour session deadline and the 1% rake charged again on
every re-entry.** Across a session those turn the counter's edge into roughly
**two to four dollars an hour**, which is disclosed as the honest figure rather
than a defence the table does not actually mount.

**Provably fair here is scoped to the randomness only.** It means the shoe is
committed before it is dealt, derived from an input nobody controls, and
verifiable by anyone afterwards. It does not mean even money.

## The house holds cards

**The house bankroll is itself cards of the table series.** The desk holds a
pool of the same chips it pays out, called the float, plus a small USDG
treasury the keeper uses only to grow or bank the float and never to settle a
hand.

This is the single most important operational fact about the cabinet, and it
matters to a player rather than only to the Manager. Because winnings are paid
in cards from the float, an exit reads no price, quotes nothing, and calls the
Long-Dated Desk not at all. It is a plain transfer of a count of cards. There
is no marked-to-market coverage, no shortfall path, and no on-demand
conversion anywhere a player can reach.

The game is played in chips and it is zero-sum between the house and the
players, so the house's net card position is the float minus what it owes open
sessions, and that net drifts upward only by the house's edge. The float is
not an unhedged directional bet the size of the bankroll. It is the coverage
the desk must hold to pay winners, and its slow upward drift is the house's
profit.

**The house's exposure to a knock is exactly the float, and nothing more.** A
knock zeroes what the house owes players at the same instant it zeroes what the
house holds, so the two cancel and the desk is never left owing a live player
against dead cards. At 5x a knock needs a 20% NVDA fall through the barrier,
and the keeper is barred from topping the float up within 5% of K, so a float
is never refilled into an imminent knock. That is the whole risk, and it is the
position the fund accepts deliberately.

The 5% performance fee lands in exactly one place. The house wins cards into
the float as its edge, and the keeper periodically sells the float's excess
above its operating band for USDG. That sale is the only place the fee is paid,
and it is paid on realised profit. The hot path pays no fee at all.

## Solvency

Because the bankroll and the payout are the same asset, solvency is one
statement in cards with no price anywhere in it.

* **Held cards cover every obligation, always.** The desk's card balance is
  never less than the chips escrowed across all open sessions, plus the most
  those sessions could still win, plus the withheld rake, plus any unclaimed
  payouts. This is checked at sit-down and on every path that removes a card.
* **A new sit-down is refused unless the spare coverage is already there.** The
  reservation is the worst case, the full amount a session could still win from
  the moment it sits, not the expected. If the float cannot cover it, the
  sit-down is refused rather than forcing a market buy.
* **An exit is never refused.** The cards to pay it are already on the desk, so
  standing up needs no swap, no quote, no price feed and no market hours.

Session sizing follows. A session's cap is **five times the chips deposited**,
and the maximum bet is set so the desk can cover the worst possible outcome of
one hand: split to four hands, each doubled, each winning, which pays eight
times the bet. Blackjack's 3:2 is smaller and does not bind. **A session can
never leave with more than its cap**, so everything the desk could owe is
bounded before the first card is dealt. At a five-times cap a $100 seat, seated
with 93 chips after the door rake, has a session ceiling of about $465.

**No single seat may reserve more than 10% of the float.** That does two jobs
with one constant: it stops one large seat from exhausting the shared coverage
and locking everyone else out, and it caps a card counter's maximum session win
at something the float can absorb.

Manager withdrawals from the float are floored: the Manager may drain the desk
to zero deliberately, but may never leave a nonzero balance below the operating
floor, and may never defund a reservation on an open session. The USDG treasury
has its own floor so the keeper always keeps gas to rebalance.

### The float band, and where USDG comes in

The float has a Manager-set operating band, 25% to 75% of the greater of 2,000
chips and the total reserved. Both legs that keep it inside the band are the
keeper's, they are lazy, and neither is ever on a hand's path.

* **Below the floor** the keeper buys cards with the USDG treasury to
  replenish coverage, so the next sit-downs are not refused for want of it.
  Reaching the floor blocks new sit-downs, never exits.
* **Above the ceiling** the keeper sells the excess for USDG, banking the
  house's accumulated edge and paying the 5% on realised profit.

Because buying happens only when coverage is low and selling only above the
ceiling with hysteresis, a sit-down followed immediately by a stand-up does not
round-trip a fee. An attacker who tries to force one pays the door rake and
moves nothing else. The house trades on its own schedule or not at all.

## The table runs around the clock

US equity feeds go quiet at night, on weekends and on holidays. This table
does not, and that is a hard design constraint rather than a nicety. **No path
a player takes reads a price.** Sitting down transfers cards and reserves a
count of cards. A hand is decided by the sealed shoe. An exit transfers cards
from the float. None of them consults the NVDA mark, so a total feed blackout,
Chainlink and the pinned pool both dead, blocks nothing a player does. Only the
keeper's float rebalance reads a mark, and it is not on any player's path, so a
weekend that blocks the keeper simply defers the rebalance until the market
reopens while the table keeps dealing.

## Two transactions a session, cooperatively

Playing a shoe does not put a transaction on chain per hand. The happy path is
two transactions, sit down and stand up, no matter how many hands are played,
and no price feed anywhere on the path.

Hands settle in a two-party payment channel, which is a solved and ordinary
construction. **Every state carries two signatures, the house's and the
player's**, and a state is simply the player's position if the session ended at
that moment. Neither side can produce a state alone, and that single fact is
the whole security argument. The house cannot invent a position the player
never agreed to, and the player cannot invent one the house never agreed to.

* **Sit down.** The player transfers chips to the desk. The desk withholds the
  door rake, credits the stack, reserves the session cap, records the first
  shoe's commitment and named round, records an ephemeral session key the
  player's wallet authorised for signing, and sets a session deadline.
* **Play.** Hands resolve off-chain and instantly. A bet is co-signed before
  any card is dealt, with the chips already debited, so a player who walks out
  of a hand they dislike has already signed the bet away and closes at that
  debited state. When the hand resolves, both sides co-sign the new position.
  The player holds a growing chain of co-signed states and the newest one is
  their position.
* **Stand up.** On the cooperative path the house co-signs a final state at the
  true position and one transaction pays it, with no wait and no window. If the
  house will not cooperate, the player closes with their newest co-signed state
  themselves, which opens a short challenge window during which either side may
  replace it with a higher-numbered co-signed state, after which it settles at
  the newest one recorded. The challenge window is one hour.

Restoring the float to its band afterwards is the keeper's job on its own
schedule, never the player's wait. If a session is abandoned it is expired
after its deadline at its newest recorded state, releasing the reservation. The
session deadline is four hours, with a one-hour window in which only the player
may trigger the expiry before it becomes permissionless.

### What protects a player, and what does not

The channel bounds the player's exposure to **at most one hand's bet**, and
with co-signed states that is now true rather than merely asserted:

* If the house refuses to co-sign a hand's resolution, the player closes at the
  debited bet state and is out exactly that one bet.
* If the house goes silent entirely, the player closes with their newest
  co-signed state and waits out the challenge window.
* If the house tries to close at a stale state, the player challenges it with
  the newer state they hold.
* The house cannot invent a state, because it has no player signature for one.

The reciprocal holds in the house's favour, which is the property an earlier
one-sided design lacked in both directions: it let a player exit at a session
peak rather than a final position, and it let the house zero a seated player in
one transaction. Co-signing closes both.

What this version still does not have is an on-chain adjudicator that could
replay a disputed hand and settle it at the true outcome. Building one means
writing the blackjack rules a second time in Solidity, matching the engine
exactly, which is the largest audit surface in the cabinet, in exchange for
removing a bounded one-bet exposure. That trade is deferred for a first
deployment and disclosed here rather than implied away.

## Fairness, stated per actor

The desk does not claim to be even-money, because it is not. The provably-fair
claim is scoped to the randomness.

* **The player, and any third party.** Every card is a pure function of the
  shoe seed and its position, and the seed's inputs are all fixed before the
  drand round publishes. After the shoe closes, anyone can re-derive the whole
  thing and replay every hand against the bound log. Nothing the player does
  during the shoe changes a card.
* **The operator.** The operator cannot deal a card other than the one the
  committed shoe contains without breaking a published commitment. It cannot
  choose the seed, because it commits its secret before the drand round exists
  and the shoe id is derived rather than supplied. It cannot aim a shoe at a
  particular player, because the client entropy is in the seed. It cannot deal
  whichever pipelined shoe it prefers, because the order is anchored on chain.
  What it can do is set the rules, and the edge those rules carry is measured
  and printed above.
* **The sequencer.** Naming a round that already exists would require the chain
  operator to falsify timestamps beyond the measured skew margin inside the
  commitment delay, and the fail-closed checks turn a larger skew into reverted
  transactions rather than exploitable shoes. This is disclosed as the design's
  residual trust assumption rather than argued away.

## Parameters

| Parameter | Value |
|---|---|
| Chip | One TURBO CALL card on NVDA, single designated table series |
| Table series leverage | 5x, K set 20% under the mark at listing |
| Chip size | About $1 of card value |
| Table minimum | 2 chips |
| Bets | Even numbers of chips, so 3:2 pays exactly |
| Rules | 6 decks, dealer stands on all 17, blackjack 3:2, double any two, double after split, split to 4, aces split once, no resplit aces, no surrender, no insurance |
| House edge on the rules | 0.426% of the initial bet against basic strategy, measured over 40 million simulated hands, asserted in a band on every engine test run |
| Door rake | 100 basis points of the chips deposited, rounded up to the whole chip, withheld at sit-down, split 50/50 Manager and Sleeve, non-zeroable |
| Per-hand charge | None |
| Costs charged by the Long-Dated Desk, not by this cabinet | 5% open fee plus 1% buy markup on acquiring chips; 5% of net profit on close, and a flat 5% of value on chips won rather than bought |
| Randomness | Sealed shoe, seeded by the drand signature, the house secret, the client entropy and a derived shoe id together, all fixed before the round publishes, commitment anchored on chain |
| Beacon waits | One per shoe, about 15 seconds, and none at all after the first shoe because the next shoe is committed while the current one is played |
| Reveal | House secret published at shoe close, bound to the hand log; anyone can replay every card |
| Card counting | Works. Disclosed rather than defended against, and bounded to roughly $2 to $4 an hour by the four-hour deadline and the re-entry rake |
| Shoe penetration | 75%, the cut card after 234 of 312 cards |
| Worst case reserved per hand | 8x the bet, being four split hands each doubled and each winning |
| House bankroll | Cards of the table series (the float), plus a small USDG treasury the keeper uses only to rebalance the float |
| Session cap | 5x the chips deposited, about a $465 ceiling on a $100 seat |
| Per-seat coverage cap | No single seat may reserve more than 10% of the float |
| Session deadline | 4 hours, with a 1-hour window in which only the player may expire it |
| Channel challenge window | 1 hour |
| Transactions per session | Two, sit down and stand up, regardless of hands played |
| Float operating band | 25% to 75% of the greater of 2,000 chips and total reserved |
| Table series tenor and roll policy | The longest tenor that still expires before the next NVDA ex-dividend date |
| Owner functions on any fund contract | None |

## Risk factors

* **THE CHIPS CAN GO TO ZERO WHILE YOU ARE SITTING AT THE TABLE.** A chip is a
  leveraged NVIDIA position with a financing level 20% under the mark at
  listing. If NVDA touches that level, every chip in the game is worth zero at
  once, there is no residual, and there is nothing to claim. Winning every hand
  does not help. This is the defining risk of the cabinet and it is not
  mitigated, it is disclosed.
* **The game is negative expected value.** The rules carry a 0.426% house edge
  against basic strategy, and a player who does not play basic strategy faces
  more. The door rake takes another 100 basis points of the stack. Playing
  TURBO BLACKJACK is not a way to make money, and nothing in this documentation
  should be read as suggesting it is.
* **Market risk on NVDA, in both directions and levered.** The stack's dollar
  value moves with NVIDIA at roughly five times the stock's percentage move,
  while you play and while you hold the chips afterwards. A player who ends the
  session with more chips than they started with can still end it with less
  money.
* **A series can also expire or void, and those are not the same as a knock.**
  If the tenor runs out the cards settle at the mark, and if a corporate action
  such as a dividend voids the series the premium is refunded, in both cases by
  the holder's own call at the Long-Dated Desk. A void is worse for a winning
  holder than an expiry, because it returns the premium paid rather than the
  appreciated value, and the table is rolled ahead of each NVDA ex-dividend
  date to avoid one mid-session.
* **Fees charged elsewhere.** Acquiring chips costs the Long-Dated Desk's 5%
  open fee and 1% markup, and cashing them out costs 5% of net profit, or a
  flat 5% of value on chips that were won rather than bought. Those are that
  desk's charges, they are documented under
  [Long-Dated Desk (TURBO)](/turbo), and this cabinet does not control or
  refund them.
* **Card counting cuts both ways.** The shoe is countable by design, which is
  disclosed above as a property of the game. It is not an invitation: a
  counter's edge works out to roughly two to four dollars an hour after the
  four-hour deadline and the re-entry rake, and a player who believes they are
  counting and is not is simply deviating from basic strategy at a larger edge.
* **One hand of counterparty exposure.** Hands settle off-chain against
  co-signed states, and this version has no on-chain adjudicator. A house that
  stopped co-signing could cost a player at most one hand's bet, because the
  bet is debited in a co-signed state before the cards are dealt and the player
  closes at that state. It is bounded, it is not zero, and it is disclosed
  rather than engineered away in this version.
* **Liveness.** The cabinet's server deals the hands. If it disappears
  mid-session, the player closes with their newest co-signed state and leaves;
  if they do not, the session can be expired after its deadline at that same
  state.
* **The float is operational.** The house bankroll is Manager capital held as
  cards, and its size is set by the Manager. Reservations on open sessions are
  always protected and exits are never refused, but maximum session sizes and
  how many seats can be open at once rise and fall with what is there, and are
  not a commitment.
* **Tokenization risk.** NVDA is a tokenized stock and carries the issuer and
  redemption mechanics of its tokenization, which are not the fund's to
  control. The card is a claim on the Long-Dated Desk against that mark, not
  stock ownership.
* **Sequencer trust.** The commitment delay assumes the chain's sequencer
  reports honest timestamps within the measured skew margin, with fail-closed
  checks behind it.
* **Smart-contract risk.** The desk is a new contract, in addition to the
  Long-Dated Desk, Rialto, Chainlink and drand infrastructure it composes with.

The cabinet is a parody dress. NVDA is the ticker the tokenized stock
identifies itself by on chain, and the felt and the card art are the fund's
own. TURBO BLACKJACK is not affiliated with, sponsored by, or endorsed by
NVIDIA Corporation.

The chips are described in full under
[Long-Dated Desk (TURBO)](/turbo); full fund mechanics are in
[The Fund (Mechanism)](/mechanism); the Sleeve that receives half of the door
rake is described under [Real World Bonds](/rwa-desk); the complete risk
section is [Risk Factors](/risks). Nothing here is investment advice.