Four Winds

Lightning to crash the bird
Hawk attacking the bird and crashing
Frost freeze for the bird crash
The bird taking flight

Inspiration

We were inspired by Aviator-style crash games, where a multiplier climbs until it suddenly crashes and the player has to cash out in time, and by the hackathon's four seasons theme. We asked what happens if the risk is not constant, but changes with the seasons, the way a migrating bird's does.

Crash games are also where problem gambling and fraud show up most. So we made player protection and fraud detection part of the game from the start.

What it does

Four Winds is a crash game starring a migrating bird. You place a bet, the bird flies and the multiplier rises, and you cash out before it crashes.

Seasons change the risk. Spring is gentle, summer is steady, autumn gets riskier, and winter pays the most but is the most dangerous. Seasons change automatically after a random 4–9 seconds, with no on-screen countdown, so you have to read the world instead of a timer.
The bird can die in different ways. Storms, predators, cold and exhaustion each have their own 3D death animation, and the scene blends smoothly from one season to the next.
Provably fair. Every round's outcome is committed to with a SHA-256 hash before it starts and revealed afterwards, so anyone can verify the server did not cheat.
Player protection. Each player gets a live behaviour profile with a loss limit, a cool-off period and plain-language warnings for things like chasing losses, very fast play and long sessions.
Sentinel, a real-time fraud agent. It watches every settled round and tests whether a player wins more often than the odds allow. It also flags bot-like timing, superhuman reaction times, shared accounts, and impossible travel when a player opts in to coarse location sharing (about 1 km).
Live judge drawer. A side panel shows what Sentinel is thinking as it happens, including a cheater simulation so you can watch it catch one.

How we built it

Zero-dependency Node.js server (ES modules) and a vanilla JavaScript client, with three.js for the 3D scene.
The server is the authority on every game result. Balances are stored in integer cents and bets use idempotency keys, so a double-click cannot double-charge. Live updates are sent over Server-Sent Events.
Fairness uses an HMAC-SHA256 seed and a SHA-256 commitment.
The crash point follows a standard crash-game distribution with a 3% house edge. The chance that a fixed cash-out target $m$ wins is

$$P(\text{win}) = \min!\left(1-b,\; \frac{1-e}{m+0.01}\right)$$

where $e$ is the house edge and $b$ is the season's extra bust chance. Every target returns 97% over time (the RTP), and seasons change volatility, not the long-run return.

Sentinel uses one-sided z-tests. It compares a player's actual wins with the sum of the exact win probabilities of their rounds, and separately checks their return against 97%. It needs at least 100 rounds and a strong signal before raising a review. We tested it on simulated honest players to confirm it almost never accuses them.
Accounts use scrypt password hashing with lockout. Fraud flags are never shown to players, and only the protection rules act on their own.
36+ automated tests cover the engine, the API, protection, Sentinel and accounts.

Challenges we ran into

Telling skill from cheating. A high win rate at a low cash-out target is normal. The same rate at 2× is not. Sentinel therefore compares wins with the exact odds of each round's target, instead of using a flat win-to-loss ratio.
Avoiding false accusations. We tuned the thresholds so honest players almost never reach review, and we made Sentinel flag for a human to look at instead of banning anyone automatically.
Making the seasons feel natural. Early versions looked like only the colours were changing. We rebuilt the scene so light, fog, weather and foliage blend continuously.
Hosting behind a proxy. Behind a host's proxy every visitor shares one address, which would make the fraud checks think everyone was one person. We added a trusted-proxy option to read the real client address.

Accomplishments that we're proud of

A crash game where the fairness is verifiable and the fraud detection is statistically sound, not guesswork.
A fraud agent whose reasoning judges can watch live.
Responsible-gambling features built into the core design.

What we learned

How crash-game maths works, and why no strategy can beat the house on average.
How to turn "this looks suspicious" into a proper statistical test.
That fraud detection should support human reviewers, not replace them.

What's next for Four Winds

Sequential testing (SPRT/CUSUM) so cheaters are caught faster with a known error rate.
Persistent storage, since game state currently lives in memory.
Multiplayer rounds and a leaderboard.
More species, routes and migration events.