Create with wallet A
Connect a funded Base Sepolia wallet, create an expedition, then copy its invite link. Creating publishes the match and player-one address, not a position.
Wallet transaction
Field manual · Complete rules
Find the Core.
Mislead the rival.
Get home.
HEXTRACT is a two-player, simultaneous-order extraction duel on a 7×7 battlefield. You have eight rounds, two actions per round, two integrity, and two decoys.
Your first live expedition
From invite link to first move
Use two browser profiles so each commander has a different address and private decryption session.
Join with wallet B
Open the invite in a separate profile or incognito window and connect a different wallet. Joining funds three encrypted random draws for both spawns and the Core.
Wallet transaction
Reveal your own sightline
Each player selects Reveal my sightline. The wallet authorizes a private attested decrypt; only that wallet receives its position and compact report.
Private wallet signature
Plan, seal, repeat
Choose two orders, encrypt them in the browser, confirm one submission transaction, then decrypt fresh intel after both plans resolve.
Encrypt → transaction → decrypt
The round loop
Plan together. Learn separately.
A plan is two ordered slots, not two separate transactions. The rival can see when you are ready, never what you queued.
Tactical timing
Both players’ movement is applied before either scan or attack in a slot. Operatives may overlap or swap, but an attack still requires an orthogonally adjacent target after those moves. Predict where the rival will be—not only where you last saw them.
- 1
Choose two slots
Set an action and target for slot 1 and slot 2. You may revise either until you transmit.
- 2
Encrypt in-browser
Both orders are packed into one value and encrypted for this contract and wallet.
- 3
Confirm submission
Your wallet sends one ciphertext and the current Inco fee. The plan cannot be edited after confirmation.
- 4
Wait for the rival
Readiness is public, but order contents are not. The second submission resolves both queues.
- 5
Resolve slot 1, then 2
Within a slot, movement happens before decoys, scans, attacks, Core changes, and extraction. A slot-1 finish stops slot 2.
- 6
Decrypt and adapt
Refresh your private sightline to learn your new position, integrity, inventory, signals, hits, damage, and permitted sightings.
Command deck
Six actions. Exact target rules.
The contract resolves invalid choices silently, so check range and terrain before sealing your queue.
HLDHold
Target · No meaningful target
Stay in your current sector for this slot. The encoded target is ignored.
After a deadline, an unsubmitted two-action queue becomes two Holds when anyone enforces the timeout.
MOVMove
Target · 1 orthogonal neighbor
Move exactly one sector up, down, left, or right. Diagonals and jumps are invalid.
Deep bog blocks Move only. Operatives do not block each other, so they may overlap or swap; an invalid Move quietly becomes a Hold.
SCNScan
Target · Any battlefield sector
Probe one sector and privately receive SILENCE, FAINT, STRONG, or CONTACT.
The strongest real-or-decoy signal wins. A relay boosts a non-zero result by one band, capped at CONTACT.
ATKAttack
Target · 1 orthogonal neighbor
Movement resolves first. Your preselected target must then be one orthogonally adjacent sector and contain the rival.
A hit removes one integrity. Overlapping does not deal damage: same-sector, diagonal, distant, and empty-sector attacks do nothing.
DCYDecoy
Target · Your sector or 1 neighbor
Spend one of your two beacons to create a false proximity signal at a valid nearby sector.
Bog blocks movement, not placement: a valid Decoy may sit there. It lasts for the placement round plus two more; redeploying replaces it, and a rival stepping there clears it.
EXTExtract
Target · No remote target
Win if you already carry the Core and occupy your own extraction gate when this slot resolves.
Extract does not move you. Queue Move in slot 1 and Extract in slot 2 if you are one step from home.
Within each action slot: valid movement → decoy deployment/clearing → scans → attacks and damage → Core pickup/drop → extraction and outcome. Both players use the same encrypted resolution order.
Signals and visibility
A signal is a clue, not a reveal.
Distance is Manhattan distance: count orthogonal steps, not diagonals. Scans compare the target with the rival and their live decoy, then return only the strongest band.
CONTACT0 sectors
The target sector contains the rival or an active decoy.
STRONG1 sector
The rival or decoy is orthogonally adjacent to the target.
FAINT2 sectors
The closest real or false signal is two Manhattan steps away.
SILENCE3+ sectors
No rival or active decoy is within the scan’s two-sector range.
Relay rule: scan a public relay sector and any non-zero band rises once—FAINT to STRONG or STRONG to CONTACT. SILENCE stays SILENCE.
Direct sight
Two sectors changes everything.
When a living rival is within two Manhattan steps of you, your next private report reveals their exact sector and Core-carry flag. Outside that radius, the rival character stays absent.
Your report reveals
- Your exact sector
- Integrity and decoys
- Scan band
- Hit and damage flags
- Your Core custody
- Authorized rival sighting
It never reveals
- Rival action queue
- Rival integrity
- Rival decoy inventory
- Hidden Core sector
- Distant rival position
- Whether a signal is bait
If both of your slots scan, the report keeps the stronger result. Visual discovery and terrain shading are interface aids; permissioned encrypted reports enforce the actual secrecy.
Core protocol
Find it. Keep it. Bring it back.
1
Entering or occupying the hidden Core sector while alive picks it up automatically.
2
If both operatives reach the available Core in the same slot, it is contested and neither picks it up.
3
If a carrier reaches zero integrity, the contract records a drop—but elimination decides the match immediately, so play does not continue.
4
Core location and custody remain confidential; your private report tells you when you are carrying it.
How the match ends
Extract
Carry the Core to your own gate and spend an action slot on Extract.
Eliminate
Reduce the rival from two integrity to zero. If both fall in the same slot, the result is a draw.
Round-eight verdict
A Core carrier wins. With no carrier, the closer operative to the Core wins; equal distance is a draw.
Timeout
A first miss inserts two Holds and resolves. A second cumulative miss forfeits immediately; simultaneous second strikes draw.
Round eight: after the second slot resolves, orders lock and the confidential tiebreak outcome waits for attested finalization.
Confidential during play
Fog enforced by the contract.
Inco keeps tactical values as encrypted handles and computes the round inside its TEE-backed confidential system. This is selective decryption, not visual concealment or FHE.
Exact positions
Both action queues
Integrity and decoys
Core location/custody
Scan and hit results
Unpublished outcome
Public by design
Enough state to coordinate fairly.
Player addresses, game ID, round, deadline, readiness flags, timeout strikes, status, fixed terrain, transaction history, and opaque ciphertexts/handles are public. Plaintext tactics are not.
Attest the outcome
Either player can checkpoint the exact outcome handle, privately decrypt it with covalidator signatures, and submit the attestation. The contract verifies the proof and handle before publishing winner or draw.
If the checkpoint says no winner yet, play resumes with a fresh planning window. A public timeout result may still be superseded by an already-produced confidential gameplay outcome.
Field questions
Before you enter the fog
Can a block explorer read my plan?+
It can see that your wallet submitted, the round, transaction value, and an opaque ciphertext. It cannot read the two plaintext actions or targets from calldata or contract state.
Why did a valid-looking action do nothing?+
Hidden-state failures are silent. A blocked or non-adjacent Move becomes a Hold; an Attack misses unless the rival is on the chosen adjacent sector; a Decoy fails when its target or inventory is invalid.
When does the rival appear on my map?+
Only while alive and within Manhattan distance two of your operative. Your private report then includes the exact rival sector and whether they carry the Core. A scan by itself never reveals the character.
Why can CONTACT still be bait?+
A scan uses the strongest signal from the rival and their active decoy. Both create the same proximity bands, so CONTACT identifies a signal source—not which source it is.
What happens when the clock reaches zero?+
Anyone may select Enforce missed orders. On a player’s first miss, the missing queue becomes Hold/Hold, gains one public strike, and the round resolves. A second cumulative miss causes an immediate forfeit without resolving either queue; if both players receive their second strike together, the match is a draw.
Why are two browser profiles needed?+
A live duel requires two addresses and two separate wallet authorization sessions. One ordinary profile plus an incognito window works, provided each connects a different wallet.
Ready for the fog?
Learn the loop by playing one expedition.