The ladderis: rating, LP, tier, streaks, series, season history, and a hash of every game’s score sheet. The moves are not. Putting them there would mean a legal move generator written in Solidity, variant pieces included, and forty-odd transactions per game to arrive at a result the referee already knows.
So a server referees the games and signs the outcome. It cannot invent a player, settle between wallets that never registered, or write a rating directly — every settlement runs the contract’s own rules over two opted-in addresses. It can lie about who won.That is the trust assumption, it is written into the contract’s source, and the fix is a multisig rather than a promise.
Since a game now costs a stake, that assumption is worth restating in money: the signer decides who pays. The contract limits what it can do — the fee is capped, the protocol’s share can never be swept out of player deposits, and your balance is withdrawable at any time, even paused — but the ladder is upgradeable, and an upgrade can change the rules under stored funds. On a testnet with faucet AVAX that is a small thing to accept. It would not be on mainnet, and it is why the owner belongs in a multisig before this pattern goes anywhere real.