# Reverse-Plinko RWA Desk (SPACEX INVADERS) > **Status: the desk is operating on mainnet.** SPACEX INVADERS opened on > 11 August 2026 and is served from the arcade at play.netnet.capital. > Contract addresses are published on > [Official Channels](/official-channels) and nowhere else. > **Participation is restricted to persons 18 years of age or older.** > Dollar figures on this page are the deployed parameters, quoted at the > market price of SPCX where so labeled, and never a promise. SPACEX INVADERS is a reverse-Plinko cabinet skinned as the 1978 arcade game. A ship at the bottom of the screen fires a ball upward through a field of space rocks, the ball ricochets from rock to rock, and it lands on one of nine alien buckets across the top. Each alien is labeled with a payout multiplier, and the shot pays that multiplier times the stake, in SPCX, the tokenized SpaceX equity that trades on Robinhood Chain through Rialto. A future round of a public randomness beacon decides where every ball lands. This game is not even-money, and the documentation says so first. **The board carries a house edge that is printed on the aliens.** Across the landing distribution the multiplier ladder returns about **90% of the stake on average**, and a flat **5% fee** applies on top of that, for a combined expected return of about **85.5%**. The edge lives in the table and in the fee, both disclosed, and neither is buried in the animation. This is the Superstore's honesty model, not COINflip's: COINflip's coins are exactly fair and its fee is the whole edge, and that sentence is false about this game, so it does not appear here. The game is a cabinet in the fund's RW-PLAY thesis: tokenized real-world assets are natural play pieces for on-chain games. In SPACEX INVADERS a tokenized equity is the stake, the pot, and the prize, settled in seconds. Every USDG bet is a live Rialto fill into SPCX at placement, and every sell-back after a win is another. The consumer application speaks plain English by design. Its HOUSE RULES panel carries the edge disclosure and the fee disclosure in full and links here. This page is the controlling description of the mechanics. ## The game * **The board.** A ball launches from the ship and bounces down through **8 rows** of space rocks, going left or right by one bit of the beacon at each row, and lands on **one of 9 alien buckets** at the top. The bucket is the count of right turns, so the landing distribution over a symmetric board is binomial: the center buckets come up often and the edge buckets rarely. * **The ladder.** Every alien is labeled with its multiplier, and the ladder is symmetric with cheap center buckets and rich edges. The launch ladder, the only risk tier at launch, is printed in full below. The shot pays **the alien's multiplier times the per-ball stake**, in SPCX. * **The batch.** A bet buys up to **100 balls at once** at a per-ball stake, for example twenty-five balls at one dollar each. The whole batch is decided by **one beacon round**: the round is named at placement, its signature expands into every ball's path, and there is a single wait of about **15 seconds** for the batch rather than one wait per ball. Once the round publishes, the magazine fires and every ball animates its predetermined flight to its predetermined alien. The total payout is the sum across the balls. * **Minimum bet.** The all-in amount for the whole batch, stake plus fee together, must be worth at least **$5** at the price feed's mark. The minimum is on the batch, not the ball, so twenty-five balls at one dollar clears and a single one-dollar ball is refused as dust. * **Maximum bet.** Set by the coverage cap described under the house fund below, and shown live in the application as the largest batch the bankroll can cover. * **Lifecycle.** Placing a bet locks the stake and fee, names the randomness round every ball in the batch will use, and **reserves the batch's worst-case payout from the house fund**, which is every ball landing on the top multiplier. A batch the fund could not pay in the worst case is refused at placement rather than owed later. Once the round publishes, settlement verifies the beacon's signature on chain, derives one path per ball, and pays the sum. Bets are non-transferable, and each batch's reservation is held individually. ## The ladder, and the edge printed on it The board is deliberately negative expected value, and the multipliers that make it so are printed on the aliens, visible before and during play. This is the whole disclosure and it is never softened into a fairness claim. The launch ladder has 8 rows and 9 aliens, one risk tier. The probability of each bucket is the binomial weight over 256 equally likely eight-bit paths. | Alien (right turns) | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | |---|---|---|---|---|---|---|---|---|---| | Probability (in 256) | 1 | 8 | 28 | 56 | 70 | 56 | 28 | 8 | 1 | | Multiplier | 25× | 2.7× | 1.2× | 0.5× | 0.2× | 0.5× | 1.2× | 2.7× | 25× | The probability-weighted multiplier is `230.4 / 256`, which is **exactly 0.9000**. The board returns 90% of the stake on average, so the board itself carries about a 10% edge, and the 5% fee below sits on top of that. The contract asserts at deployment that the active ladder's expected multiplier is inside a tight band around 0.90, so the board can never be quietly rigged to pay less than it advertises. That assertion protects the player. **It is not a claim that the game is even-money, because it is not.** The consequence of an average is the part that matters to a player, so it is stated alongside rather than left implied. An average across the ladder is not a property of any single ball. The single most likely landing is the center alien at 0.2×, and the two 25× edges together come up about eight times in a thousand balls. A player should expect most balls to pay less than their stake, and the 90% arithmetic is a statement about the board, not a forecast of any one shot. Playing SPACEX INVADERS is not a way to make money, and nothing in this documentation should be read as suggesting it is. ## Aim is cosmetic The ship moves left and right, and moving it changes the animation and nothing else. **Where a ball lands is decided by the beacon, not by the ship's position.** Every launch column yields the identical outcome distribution, and the payout derivation is provably independent of the launch column. The launch column is recorded only so the shot can replay from the point it was fired. This is stated plainly because the honest description of the control is that it has no effect on the odds. The application does not tell a player to aim carefully or line up a shot, because doing so would imply an influence the control does not have. The ship is flair. The beacon is the outcome. ## Every leg is SPCX The stake, the payout, the house's liability, and the house's bankroll are all denominated in SPCX units. One SPCX staked against a multiple of SPCX owed is solvent at any price, so the game itself never depends on a price feed. The only legs that need a price are the two conversions, and those are exactly the legs gated on market hours: * **Bet in SPCX.** No conversion and no price needed. SPCX bets run around the clock, weekends included. The batch stake plus the 5% fee transfer in SPCX. * **Bet in USDG.** The desk takes the fee from the USDG side, then converts the full stake to SPCX through Rialto at placement, one live fill per batch, and the game proceeds SPCX-native from there. Off-hours a stale feed pauses that on-chain conversion, so the application buys the SPCX in your own wallet at the live market price and bets that instead: a USDG bet is never blocked, though the off-hours fill pays a wider spread and is refused in the rare case that SPCX has moved too far from the oracle. * **Win.** The payout arrives as SPCX from the house fund, so a winner is holding SpaceX stock. A one-tap sell-back converts SPCX to USDG through Rialto while the market is open; on a weekend the button queues the sale for the reopen, and the queued sale executes at the reopen price, not the price at the time of the tap. * **Loss.** The staked SPCX joins the house fund. Nothing converts. ## The fee, and where it goes The fee is **5% of the batch stake, fee-inclusive**. The amount entered is the total spent, and the stake is that amount divided by 1.05, so the fee is never a surprise added at the end. The 5% splits in half, and both halves are immutable constants of the deployed contract: * **2.5% to the Manager.** The management company's revenue from the game, accrued in the currency each bet was placed in and swept to the team multisig. * **2.5% to the NetNet RWA Sleeve**, the disclosed portfolio of tokenized real-world assets the Manager holds for the protocol's benefit, described under [Real World Bonds](/rwa-desk). SPCX-side fees sweep to the Sleeve directly; USDG-side fees convert to SPCX at sweep time, while the market is open, and follow. Two clarifications belong next to the split. First, **nothing from this product reaches the Treasury**. Other fund products remit a fee to the reserve from their first sale; this one deliberately does not, and no page of this documentation extends that claim to SPACEX INVADERS. Second, the Sleeve is **not part of the fund's on-chain reserves (RFV) or backing**, and no NET is backed by Sleeve assets. Any future use of the Sleeve to support the fund is at the Manager's discretion, as disclosed on the [Real World Bonds](/rwa-desk) page. Fee sweeps are permissionless: `sweepFees()` is callable by anyone at any time, and the fund's keeper calls it on a thirty-minute cadence. Cumulative sweeps to the Manager and the Sleeve always equal cumulative fees charged; neither half can be redirected or zeroed at any bet size. The 5% fee is separate from the board edge and is disclosed separately. The board returns about 90% of the stake on average, the fee takes 5% of the stake, and the combined expected return is about **85.5%**. The desk states both numbers rather than folding the fee into the multipliers: the alien multipliers are always the true payout, and the fee is always shown as its own line. ## The house is the Manager The bankroll behind the game is the Manager's own capital, and this is disclosed as the product's central operational fact rather than softened. * The Manager seeded the house fund with about **$10,000**, converted to SPCX at deployment through Rialto. Liabilities are SPCX-denominated, so the fund's solvency does not depend on the SPCX price; the price exposure on the bankroll is the Manager's alone. * Anyone may add to the house fund. Only the Manager may withdraw, and a withdrawal is **coverage-floored**: it reverts if it would leave the fund below the total payouts reserved on open batches. **A placed batch's reservation can never be defunded.** * Above that floor the bankroll is operational, exactly like the Superstore's buffer. The Manager may withdraw down to the floor and refill at will, with no timelock, and the application's live coverage readout reflects whatever is actually there. * The house fund is **never protocol funds**. The Treasury, the fund's reserves (RFV), and protocol-owned liquidity are not a betting counterparty, and no code path lets them seed, top up, or backstop the bankroll. ### The coverage cap The maximum payout reserved against any single batch is an immutable formula: **5% of the free bankroll**, where free means the house's SPCX minus everything already reserved. Because a batch reserves its worst case, every ball landing on the top multiplier, the cap bounds the batch through that worst case: `balls × per-ball stake × top multiplier` must fit inside 5% of the free bankroll. At the launch seed that is a maximum reserved payout of about **$500**. With the 25× top multiplier and one-dollar balls a batch reserves about twenty-five dollars per ball, so a magazine of roughly twenty one-dollar balls clears; larger magazines use smaller per-ball stakes. The application shows the live maximum the bankroll allows. Raising the limits means the Manager seeding more; a shrinking bankroll shrinks them automatically. ## Market hours Robinhood's stock tokens trade 24/5, from Sunday 8 PM ET through Friday 8 PM ET, and are closed on weekends. The desk maps onto that calendar the only honest way: * **The game itself never freezes.** SPCX-in, SPCX-out bets run through the weekend, because no leg of an SPCX bet needs a price. * **Betting never waits; cashing out does.** The on-chain USDG conversion is gated on the market being open and the Chainlink SPCX feed being fresh within a four-hour window, because converting at a frozen Friday price would hand a free option against the house. When that gate is closed, a USDG bet still goes through, since the application buys the SPCX in your wallet at the live off-hours price and bets that; a sell-back from SPCX to USDG is what waits for the reopen. A player who holds SPCX over a weekend, whether by choice or because a queued sell-back is waiting for the reopen, carries the stock's weekend price risk. That is what holding a stock is. ## Randomness, and how to check it The outcome of every batch comes from [drand](https://drand.love), the public distributed randomness beacon, on its quicknet chain. The machinery is the same as the Superstore's and COINflip's, and it has no operator input anywhere in the outcome path. 1. The bet names its round **at placement**, by arithmetic anyone can repeat: the first quicknet round due at least **15 seconds** after the bet's timestamp. The delay exists so that the round **cannot exist yet** when the bet is placed. A threshold of independent drand nodes must jointly sign a round before it exists, so nobody, the fund included, can know any ball's landing at bet time. The 15-second figure carries a wide margin over the chain's measured timestamp skew, and the contract fails closed on both ends: a bet that would name an already-published round reverts, and a settle whose round turns out to have been published before the bet reverts. 2. Once the round publishes, anyone may relay its signature. The contract verifies the BLS signature on chain against drand's group public key, using the chain's BLS12-381 precompiles, and rejects anything the drand network did not sign. **Every ball's path derives from that one verified signature**: for ball `i` the seed is `keccak256(signature ‖ i)`, its low bits are the left-or-right choice at each of the 8 rows, and the bucket is the count of right turns. The per-ball index salts each path, so the balls in a batch land independently even though they share one round. 3. Settlement is **permissionless and unpaid**. The fund's keeper settles every batch at its own expense the moment the round is public, and the point of the permission being open is that **a bettor can always settle their own batch** without anybody's cooperation. 4. **If the beacon fails.** If a batch's round is still unpublished two hours past its due time, the bettor, and only the bettor, may void the batch for a **full refund of stake and fee**, releasing the reservation. Because settlement is permissionless, any beacon that exists is settled long before that deadline; the void exists for a true drand outage, not as anyone's discretion over a live bet. The application's fairness page shows the round number, the signature, and the per-ball derivation for every historical batch. To audit one: fetch the round from any public drand node, verify the signature, and for each ball hash the signature with the ball index and confirm the bucket the contract recorded. ## Fairness, stated per actor The desk does not claim to be even-money, because it is not. The provable-fair claim is scoped to the randomness: the draw is tamper-proof and every result is self-verifiable. What follows is true per actor. * **The bettor, and any third party.** Every ball's landing is a pure function of the batch's named round and the beacon's signature. Nothing a bettor signs, times, aims, or resubmits changes a value locked at placement, and the ship's position is inert in the derivation. * **The operator.** The operator cannot choose an outcome, cannot bias one, and cannot annul one. Settlement is permissionless, the void is bettor-exclusive, and the halt switch stops new bets only: no post-bet step, not settlement, not sell-back, not a coverage-floored withdrawal, can be halted by anyone. What the operator can do is set the edge on the board, and that edge is printed on the aliens for anyone to read before they play. * **The sequencer.** Aiming a batch at a known round would require the chain operator to falsify timestamps beyond the measured-skew margin inside the 15-second delay, and the fail-closed checks turn a larger skew into reverted transactions rather than exploitable bets. This is disclosed as the design's residual trust assumption rather than argued away. ## The arcade at play.netnet.capital play.netnet.capital is the fund's arcade hub, presented as a desktop from another decade. SPACEX INVADERS and COINflip both run there natively; **WinNET**, **CLIMB, INC.**, and **the Superstore** appear as icons that link out to their own venues at [win.netnet.capital](/winnet), [climb.netnet.capital](/climb), and [superstore.netnet.capital](/superstore). The About window carries the fund framing and the Manager's RW-PLAY letter, and each game's own long-form disclosure is the controlling document for that game. Network fees on Robinhood Chain are paid in ETH. An account created with an email address or a passkey never has to hold any: bets are gas-sponsored through the same infrastructure as WinNET's entries, subject to per-account rate limits. A player who connects an external wallet pays their own network fees in the ordinary way. The cabinet is a parody dress. SPCX is the ticker the tokenized stock identifies itself by on chain; the aliens, the ship, and the space rocks are the fund's own pixel art. SPACEX INVADERS is not affiliated with, sponsored by, or endorsed by Space Exploration Technologies Corp. or Taito, and the tokenized stock carries the issuer and redemption mechanics of its tokenization, which are not the fund's to control. ## What the desk can never do * **Touch the Treasury, protocol-owned liquidity, reserves, or emissions.** The desk holds no permission on any fund contract, is never exempt from the trading fee, and never touches the canonical NET pair. No leg of a bet involves NET at all. * **Pay out more than it holds.** Every batch reserves its worst-case payout at placement; the contract's invariants require the desk's SPCX balance to cover the house fund, every reserved batch payout, every unsettled stake, and accrued fees, at the end of every transaction. * **Defund a placed batch.** Reservations release only at settlement or a bettor-elected void, and owner withdrawals revert below the coverage floor. * **Pay less than the printed board.** The ladder is asserted at deployment to return within a tight band around its advertised average, so the board can never be quietly re-marked worse than the aliens read. The 5% fee, its 50/50 split, the coverage-cap formula, the per-ball derivation, and the refusal to price against a closed market are immutable. The Manager's settable surface is the active ladders within the asserted band, the balls-per-batch cap, the minimum bet, the halt on new bets, and sweep execution, every change event-logged. * **Keep a fee it did not disclose.** Cumulative sweeps equal cumulative fees charged, verifiable on chain. ## Program terms 1. **Operator.** NetNet Capital Management. The house bankroll is the Manager's own capital; participant stakes and reserved payouts are contract-escrowed, and the operator cannot settle, void, or redirect a batch's outcome. 2. **Eligibility.** Participants must be **18 years of age or older**. 3. **Costs.** The board is negative expected value by design, returning about 90% of the stake on average, and a 5% fee-inclusive fee applies on top, for a combined expected return of about 85.5%. The multipliers are printed on the aliens and the fee is stated separately. USDG bets and sell-backs execute through Rialto at the quoted market price. No leg pays the fund's NET trading fee, because no leg touches NET. 4. **Randomness.** Every outcome is seeded by the public drand beacon and verified on chain. Settlement is permissionless; results are independently auditable. Provable fairness here means the randomness is tamper-proof and self-verifiable, not that the game is even-money. 5. **Amendments.** The fee, fee split, coverage-cap formula, per-ball derivation, solvency invariants, the asserted ladder band, and halt scope are fixed in the deployed contract. Changes require a successor deployment, not an in-place edit. ## Parameters | Parameter | Value | |---|---| | Board | 8 rows, 9 alien buckets, one risk tier at launch | | Launch ladder | 25× · 2.7× · 1.2× · 0.5× · 0.2× · 0.5× · 1.2× · 2.7× · 25×, symmetric | | Board expected return | 0.9000× the stake on average, asserted within a tight band at deployment | | Fee | 5% of the batch stake, fee-inclusive (stake = input / 1.05); split 50/50 Manager and Sleeve, immutable | | Combined expected return | About 85.5% of the amount spent, board and fee together | | Batch | Up to 100 balls per bet, all decided by one beacon round | | Minimum bet | $5 all-in on the whole batch at the feed mark | | Maximum reserved payout | 5% of the free bankroll per batch, immutable formula | | House seed at launch | About $10,000, converted to SPCX at deployment | | Round naming delay | 15 seconds, once per batch | | Void deadline | 2 hours past the named round's due time, bettor-exclusive, full refund | | USDG legs | On-chain conversion needs market open plus a 4-hour feed-freshness gate; off-hours a USDG bet still runs by buying SPCX in the player's wallet first, while sell-back waits for the reopen. SPCX legs run 24/7 | | Fee sweeps | Permissionless; keeper cadence 30 minutes | | Halt scope | New bets only; settlement, sell-back, and coverage-floored withdrawals can never be halted | | Owner functions on any fund contract | **None** | ## Risk factors * **The board is negative expected value, and every bet is expected to lose.** The multiplier ladder returns about 90% of the stake on average, and the 5% fee applies on top, so the combined expected return is about 85.5% of the amount spent. The edge is printed on the aliens and stated in the fee, not hidden, but it is real. Most balls also lose outright: the single most likely landing is the center alien at 0.2×, and the 25× edges come up about eight times in a thousand balls. Playing SPACEX INVADERS is not a way to make money, and nothing in this documentation should be read as suggesting it is. * **Market risk on SPCX.** Winnings arrive as tokenized SpaceX stock, and a USDG bet becomes SPCX at placement. The stock's price moves, including while a sell-back waits for the market to reopen, and a queued weekend sale executes at the reopen price. * **Market hours.** Betting always works, but off-hours a USDG bet routes through an in-wallet SPCX purchase that pays a wider spread, and cashing out from SPCX to USDG is unavailable on weekends and whenever the price feed is stale. A player holding SPCX through a weekend carries the gap risk of the stock. * **The bankroll is operational.** The house fund is Manager capital, withdrawable at will down to the coverage floor. Reserved payouts on placed batches are always protected, but maximum batch sizes rise and fall with the bankroll and are not a commitment. * **The ladder can be retuned.** The Manager may change the active ladder within the band asserted at deployment. A change cannot reach a batch already placed, and it cannot make the board pay outside the asserted band, but it can change the shape of the table the next player sees. * **Liveness.** Settlement requires someone to relay the beacon and call settle. Both are permissionless and the bettor can do both personally; the two-hour bettor-exclusive void with a full refund is the backstop for a beacon outage. The operator cannot choose an outcome, but it can be slow. * **Sequencer trust.** The round-naming delay assumes the chain's sequencer reports honest timestamps within the measured skew margin, with fail-closed checks behind it. This is disclosed above rather than mitigated. * **Tokenization risk.** SPCX is a tokenized stock and carries the issuer and redemption mechanics of its tokenization, which are not the fund's to control. * **Smart-contract risk.** The desk is a new contract, in addition to the Rialto, Chainlink, and drand infrastructure it composes with. Full fund mechanics are in [The Fund (Mechanism)](/mechanism); the Sleeve that receives half of every fee is described under [Real World Bonds](/rwa-desk); the complete risk section is [Risk Factors](/risks). Nothing here is investment advice.