Integration & technical checks

Verify the token first

Use the exact Solana mint, not a symbol or a copied logo. Verify its owning token program, decimals and supported extensions with trusted RPC data. The DevFridge flow documented here uses Token-2022. A Pump.fun link by itself is not proof that a mint is compatible.

Read the published API contract

Start with sdk.devfridge.cool and the skill’s sdk-access reference. The published browser SDK exposes DevFridgeSDK; do not invent an npm package. Its check endpoint is https://scan.devfridge.cool/api/sdk/check?wallet=<wallet>&mint=<mint>. Follow the documented response and freshness semantics.

For exact amounts, the skill includes a BigInt gate helper. Validate each lock’s depositor, mint, positive raw amount and future expiry. Use verified decimals to convert a displayed threshold to raw units. Recheck when locks partially expire, the wallet changes or the page returns to the foreground.

The SDK’s subscription plans use day-based rules; sub-day eligibility and large raw amounts need the exact-policy approach explained in the skill. A stale response or failed request must show unavailable/retry, not silently grant access or report zero holdings. Coalesce requests and back off on rate limits.

Separate three decisions

• Identity: verify a nonce-based, expiring wallet challenge server-side when authentication is needed. Connecting Phantom is not authentication.
• Eligibility: check fresh DevFridge program evidence for that authenticated wallet and the exact game policy. Client checks are interface feedback.
• Competition: use server-authoritative gameplay or an appropriately secured verification design for valuable scores. Browser scores and artificially prepared valid replays are not proof of human play. Do not promise perfect anti-cheat.

Required test evidence

• Wrong wallet, wrong mint, insufficient amount and expired locks deny access.
• Exact threshold passes; partial expiry and multiple-lock policies behave as documented.
• RPC/API timeout, stale data and 429 responses show a recoverable error without granting access.
• Wallet rejection, disconnect and account switching clear the previous eligibility.
• Desktop keyboard/mouse and mobile touch can complete and restart a run.
• Background/foreground restores controls and audio; overlays do not cover the playable area.
• A clean checkout can build without embedded credentials or local-only files.