How this works, and what it isn't.

The picture

The master render is a 40 × 25 lattice — exactly 1000 squares, no remainder. It is stored outside the public directory and is never served whole. A square is only rendered by /api/tile/:id after the ledger confirms somebody owns it; for everything else the route returns 404. You cannot assemble the dog by guessing URLs, and nobody — including the people who made this — has a version of the site where the whole image is visible.

Once revealed, a square stays revealed. Selling your piece does not hide it again. The picture only ever accumulates.

The price

Issue price is a step function of how many pieces have already sold. It is computed on the server when you reserve, never sent up from the browser, and it never goes down. Open reservations count toward the total, so two people racing for the last piece of a tier do not both get the cheaper one.

If every piece sells, the primary issue raises 111.75 SOL. Secondary sales take no fee at all — the buyer pays the seller directly and nothing is skimmed in between.

One piece per wallet

This is enforced by a unique index on the owner column, not by the application remembering to check. A wallet that holds a piece cannot buy another until it parts with the one it has — the write simply fails.

It is worth being precise about what this does and does not do. It guarantees that the board shows 1000 distinct wallets when it is full. It does not guarantee 1000 distinct people. Anybody willing to fund a second wallet can hold a second piece, and there is no way to prevent that without asking who you are, which would be worse. The rule is a shape imposed on the game, not an identity system.

The market

Because holders cannot accumulate, one primitive is not enough. There are three.

listing

The holder names a price. Anybody holding nothing can pay it. The SOL goes from buyer to seller directly; the server verifies the transfer and moves the row. Listing and withdrawing are signatures, not transactions — they cost nothing.

offer

Anybody holding nothing bids on a specific piece. Nothing is escrowed, because there is no program to escrow it — an offer is an invitation, and the holder accepting it does not oblige the bidder to pay. This is written into the message your wallet shows you when you sign.

swap

Two holders trade squares. Since no SOL changes hands, no transaction is needed at all: both parties sign a message, the server checks both signatures and both still hold what they claim, and the two rows cross inside one database transaction. Free, and instant.

Read this part

What is on chain, and what is not

Sites like this one tend to be vague here. Being specific:

on chain

Every payment. Buying a piece at issue, buying a listing and paying an accepted offer are all plain SystemProgram.transfer instructions on Solana mainnet, signed by you, from your wallet, to the treasury or to the seller. There is no approval step and no program that can move funds later.

off chain

Ownership. Who holds which piece lives in a Postgres database that we run. There is no token, no NFT and no mint — your piece is a row, not an asset in your wallet.

how they're bound

A purchase reserves the piece and issues a one-time reference key. Your transfer carries that key as an extra account. The server then calls getTransaction, confirms the fee payer is your wallet, confirms the reference is present, confirms the lamports actually landed on the payee, and stores the signature under a unique index so the same transaction can never be used twice.

what this means

You can prove you paid — the transaction is public and permanent. You cannot independently prove you own a piece, because ownership is our record. If this site disappears, your payment remains on chain and your piece does not. That is the trade you are making, and it is the honest reason this was not built as an NFT collection: doing it properly on chain means a custom program and an audit, and doing it improperly on chain would be worse than being straightforward about a database.

what we can do

Everything. We could edit the ledger. The mitigation is that the whole thing is readable — every piece, every event and every transaction signature is public at /api/v1, so an altered row is checkable against the chain by anyone who cares to look.

When things go wrong

paid, nothing happened

The claim step retries for half a minute, because the RPC that serves getTransaction can lag confirmation. Your reservation stays valid for ten minutes — reload the piece page and it will settle. The signature is the receipt either way.

two people, one piece

Impossible to lose money to. A piece can only have one open reservation, enforced by a partial unique index, so the second buyer is refused before they are ever asked to pay.

the seller sold first

An accepted offer or a listing can go stale if the holder moves the piece elsewhere first. The claim re-checks who holds the piece under a row lock and refuses rather than taking your money for a piece that has left.

expiry

Reservations last 10 minutes, offers 7 days, swaps 7 days, listings 30 days. Anything past its expiry is swept before the board is read, so nothing stale is ever shown as live.