A production Telegram Mini App casino with four server-authoritative PvP games - chess, checkers, poker and durak - on the same matchmaking, escrow and settlement engine as its 12 RNG titles. Live, load-tested at concurrency, and twice audited by attackers.
It could not tell you which of its lines lets a player mint money. Five such lines existed here and were found and closed: a keno duplicate-pick path worth 2,491x expected value, a plinko row count the client could set to guarantee the 29x edge, a crash cash-out multiplier that turned every round into a risk-free win, prototype-chain access that pushed NaN into a money RPC, and row-level security policies that permitted direct balance writes.
Two adversarial audits and a concurrency run at 50 found them. Generated code does not arrive with that history, and the cost of discovering it the other way is paid out of the float.
Turnkey Telegram casino packages sell in the $10k-$30k range and ship RNG slots, a crypto rail and a bot. Player-versus-player is the piece they leave out, because it is the piece that takes months: every move is validated on the server, opponent cards are redacted server-side, stakes are escrowed on join and settled atomically, and disconnects, abandoned rooms and turn timeouts all have to resolve without losing money.
React 18 + TypeScript + Vite on Cloudflare Pages. Supabase for Postgres with row-level security, Deno edge functions, realtime and pg_cron. No vendor lock beyond Supabase, which is self-hostable.
Concurrency tested against a replica of the production schema at concurrency 50. The run found two real bugs, both fixed: a deadlock in tournament accrual and a stake loss when cancelling a waiting PvP room. Money invariants verified under concurrent load - no over-withdrawal, no lost updates, no self-matched or stuck rooms.
The product has never had a real traffic budget behind it, so its revenue has never been tested. 613 players registered, 95 played at least once, and roughly 21 are active in a given week. Real player deposits over the whole lifetime come to $1.02, real-money GGR is negative, there are no withdrawals and there is no gaming licence. Anyone valuing this on revenue should value it at zero, and we would not argue.
What those players do prove is the part that is expensive to build: 2,438 real rounds were played through the live stack, the PvP engines escrowed and settled real stakes between real opponents, and no defect was ever found in the money path. That is production evidence, which a freshly written platform does not have at any price.
28 players opened the deposit screen and 2 finished. The reasons were found and fixed in September 2026: TON auto-crediting was dead code that could never execute, Telegram Stars priced a $1 balance at roughly $3 after Apple and Google take their cut, and a player holding no crypto was shown no way to acquire any. The funnel is now instrumented end to end, so the next operator measures instead of guessing.
An operator who already holds a licence and buys traffic has all three. For that buyer this is a finished product rather than a project - the alternative being three to six months of custom development for the same feature set.