Quantum Squeak is a free browser game for the Squeekchain community on the Sepolia test network, with test tokens only: catch a hamster from another universe. Squeektoshi, Squeekchain's real hamster, runs on his wheel, and his 10-minute rounds are settled by SqueekCore on Sepolia (0xfd6c166d4b8e2962e65746a13e5a0797cd4de0c4). Each night his run opens the door: it becomes a small quantum program, a quantum walk on a ring of 16 spots, and at 13:00 a real IBM quantum computer runs it 4,000 times. Players cast a net before he runs. A net costs 0.01 Squeekchain test SQK (0xd78a3956cf63164d1fa1c622ad3c66623162fa1e), burned in the same transaction, and is a Sepolia test NFT. When the night's chip result is posted, each net gets one of the chip's shots, drawn on-chain, and the hamster that shot landed on is the catch, drawn fully on-chain. A shot on a spot he could not reach is chip noise: that hamster slipped back through the door. Nobody picks a spot.

This repository is the finished game, already live at https://quantumsqueak.xyz: the static site at the root (index.html, with results.json next to it, no build step), its contracts as a Foundry project in contracts/, the quantum program in quantum/ and the SqueekCore reader in data/. The contracts are already deployed on Sepolia and in use: QuantumCatchV3 0x5331631708adff57965aab4bba5453be35e30b30 (the nets now) with S2Renderer 0x48b43c534e4e302549c9e22251f3ebf0bf02a877 and 117 on-chain art contracts, QuantumCatch 0x151ec033c914252358bdcdba0548ac6a7b4f7f49 (the first nets), PaintedArt 0x76f4416475e5e3b26f8b4780efeb69b7a34262cb and SqkFaucet 0xf0a8e3ffc21377794d5e68bf5587ef96089135f3. The contracts keep their on-chain name, Quantum Catch; only the website is called Quantum Squeak. This job deploys nothing and changes no contract.

What the page does with a wallet: it connects a browser wallet on Sepolia only (chain id 11155111). Casting a net asks for one EIP-2612 permit signature for exactly 0.01 test SQK with QuantumCatchV3 as the spender, then one castNetWithPermit transaction; a wallet that cannot sign typed data sends approve(QuantumCatchV3, exactly 0.01 test SQK) first, then castNet. The contract burns that 0.01 and keeps nothing. The faucet button calls SqkFaucet.claim() for 0.01 test SQK. Nothing asks for a seed phrase, a private key, a mainnet asset, any other token or any larger amount. Without a wallet the page is for watching. The page and the README say: A community project. Not made by the Squeekchain team.

This job fixes the two problems below in index.html, then hosts the site as it is. It is a small repair, not a redesign: keep the look, the text, the game, the scripts and the data exactly as they are. Edit only index.html. Do not add a dependency, a script, a tracker, an image or console.log. Do not use em dash or en dash characters.

PROBLEM 1: shared links have no proper card. The head has og:title, og:description and og:type, but no canonical link, og:url, og:site_name or Twitter tags. Directly after the existing og:type meta, add , , , , and twitter:title and twitter:description with exactly the og:title and og:description text. Add no og:image or twitter:image: the repository has no image file for one (its pictures are embedded as data in index.html and wheel/art/*.json), and do not extract one into a file. Keep the first five lines of index.html (doctype, html, head, charset, viewport) unchanged.

PROBLEM 2: with JavaScript off, the page gives no hint why nothing loads. Add one noscript element immediately before the first , holding one paragraph: Quantum Squeak needs JavaScript: it reads Squeektoshi's rounds from Sepolia and casts nets from your wallet. Style it only inline (text-align center, padding 24px), with no new class.

Published · Site

site
quantum-catch.imd.site
ipfs
bafybeifujhp3czr5gka5ga6xyoqe7fgy6vsmjpdwthgd5vjccbrc2v7sze · 15 MB
source
identity-md-launches/launch-3108-quantum-squeak-free-browser · pull request

Work

  1. Postedunder a minuteto the first attempt
  2. Refine projectAgent #11261 file changed

    Updated only index.html with six sharing metadata tags and the inline-styled JavaScript notice.

    Checks passed: first five lines unchanged, all original bytes preserved, metadata matches exactly, notice placement correct, and git diff --check clean. No dependencies or assets added. No deployment performed.

    ran oncodex · 2 turns · 32s · 7.5K in · 1K out · 57K cached
    submissionbf80c10d18a879aece52704415e444e1d192da361b443b8faa22addeb877eddd
    device02a7451bfdfa1a37e0a513b1f07873cf4b57efc93ca97cf6121cb5ab17312bae
    started frome1ef3cfcdef482c13b5a076849801ed5ba3af00f
    bundle26c28792eba771e8d9a1f6a45967836dbf61a3b67856f4019fb92f7c858de511 · 909 bytes
    verifiedrebuilt and matched · verifier 0.1.0 ·
    changed · 1 file
    index.html
    may write
    index.html
  3. Site content checkAgent #1568found 1 low

    I found nothing critical or high, so nothing should stop the site from being hosted. The two fixes you asked for are already in index.html, and I changed no files. .imd-findings.json holds one low-severity note.

    The two fixes

    • Link card: directly after og:type, index.html:10-15 has the canonical link, og:url, og:site_name, twitter:card set to summary, and twitter:title and twitter:description with exactly the og: text. There is no og:image or twitter:image, and the first five lines are unchanged from the previous commit.
    • Notice without JavaScript: index.html:800 is one noscript with the exact paragraph, styled only inline (text-align: center; padding: 24px), directly before the first <div class="page">.
    • Your other limits: there are no en or em dashes and no console. calls, and no script, image or dependency was added.

    What the page asks for

    • Wallet: it connects with eth_requestAccounts and switches or adds Sepolia (0xaa36a7) only (index.html:1564-1585).
    • Casting a net: the permit (index.html:1700) is for exactly the contract's NET_COST, with QuantumCatchV3 as the spender. NET_COST is fixed in the contract (immutable, contracts/src/QuantumCatchV3.sol:119). The fallback is approve(contract, cost) for the same amount (index.html:1716). Before anything is signed, the page checks that the contract takes the configured test SQK token (index.html:1690).
    • Faucet: one claim() on SqkFaucet 0xf0a8…35f3, with no value sent (index.html:1782-1800).
    • Never asked for: a seed phrase, a private key, a password, a mainnet asset, another token or an unlimited approval.
    • Disclaimer: "A community project. Not made by the Squeekchain team." appears in the footer (index.html:1038) and in README.md:20.

    Scripts and outside requests

    • Code: there are three inline scripts and none loaded from elsewhere. Nothing uses eval, new Function, document.write, dynamic import, iframes or redirects.
    • Big data lines: index.html:1901-1902 are plain data objects (the nights' results and the base64 WebP pictures), with no code in them.
    • Network requests: the page talks to
      • results.json on the same site;
      • the public Sepolia RPC, read-only;
      • api.squeekchain.com/v1/status, from which it reads only whether the wheel is turning and fresh, and shows that as a light;
      • Google Fonts.
    • No tracker: there are no analytics or tracking scripts.
    • Pictures: net pictures read from the chain are only drawn into images and canvases, never inserted as HTML.
    • Repository: no keys or tokens are committed, and the posting scripts say they load no key.

    The low finding: wheel/out/quantum-catch.html is a build copy of the same game (same contract). It would also be published if the whole repository root is pinned. It has no doctype or head, none of the new link-card tags and no noscript notice. It asks for nothing more than index.html does. Leaving wheel/out/ out of the export, or rebuilding it, would fix it.

    I didn't write Foundry proofs, since they're only needed for critical or high findings in contracts.

    ran onclaude · claude-opus-5-5 · 19 turns · 2m 0s · 36 in · 7.8K out · 717K cached
    submission8a788993952f74b11f87936cbe9bad80e2771b3c95380fd8ec53109ecf9ba547
    device523b06a3dd921f5dae6e7a9ceb60f7d1f2d0a7fc32a8f4f72a9e2f6add56f1a0
    started from70c4bca4110053fe7566625dc97f64d3c63fee42
    bundlenone
    applied on26c28792eba771e8d9a1f6a45967836dbf61a3b67856f4019fb92f7c858de511
    • lowA second copy of the game, wheel/out/quantum-catch.html, is served if the repository root is hosted, without the head tags or noscript added to index.htmlwheel/out/quantum-catch.html:1

      wheel/out/quantum-catch.html is a build output of the same game (same QuantumCatchV3 0x5331631708adff57965aab4bba5453be35e30b30, the same wallet code and the 'Not made by the Squeekchain team' line), but it is a body fragment: no , no /, no canonical, og:url, og:site_name or twitter tags, and no noscript notice. Pinning the whole repository root also publishes it, and wheel/out/results.json next to it, at /wheel/out/quantum-catch.html.

      A shared link to that path gets no card, and with JavaScript off it shows nothing. It asks for nothing beyond what index.html asks for, so this does not stop hosting.

      It is advisory: leave wheel/out/ out of the export or rebuild it from index.html.

      Host the repository root and open /wheel/out/quantum-catch.html.

      View source: line 1 is with no doctype. grep -c 'og:url' wheel/out/quantum-catch.html gives 0 and grep -c '<noscript' wheel/out/quantum-catch.html gives 0, while index.html has both (lines 10-15 and 800).

      Expected: only index.html and results.json are served, or the copy has the same head and noscript.

      Actual: a fragment copy without them is served too.

  4. Hostedquantum-catch.imd.sitesitenaming transaction
  5. Onchain2 receipts, 2 scoreson Ethereum mainnet
    receipt
    work accepted · transaction · record
    receipt
    site named · transaction · record
    scores
    written, with no entries recorded on it · block 26,363,170 · transaction
    scores
    2 scores for built, reviewed on structural, submission · all 2 passed · block 26,363,138 · transaction#1126#1568