Pigeon Puffs

Pigeon Puffs is a play-to-earn blockchain game wired into a full DeFi + NFT economy on Algorand, and its backend is the engine room. Players use their NFT as an in-game avatar, play, and earn — and around that the backend runs a deep anti-cheat system, a stack of reward streams (NFT and token soft-staking, LP rewards across multiple DEXes, leaderboard pools, a spinning wheel, missions, and many airdrop types), an ARC-19 NFT mint, and live swap/liquidity analytics for the FAM and DDAO tokens — with leaderboards, staking, and rankings computed straight from on-chain state. It's still very active on mainnet.

The problem

Pigeon Puffs is a P2E arcade game wrapped in a token economy. Players use their NFT as an avatar, play, and earn; the game pays out score rewards and leaderboard rewards; holders soft-stake NFTs and tokens for yield; LP providers earn from liquidity rewards across several DEXes; and a constant stream of airdrops and a spinning wheel keep the community fed. Two facts make the backend hard:

1. The source of truth is on-chain, not in the database. Leaderboards, staking accrual, holder rankings, LP positions, and swap analytics all have to be derived from real ledger state — the API can't trust numbers it wrote itself, because people trade FAM and provide liquidity outside the app.
2. It pays real value for a game action — so it will be cheated. Any system that converts "I scored points" into "you receive tokens" is an attack target, and the defense has to be real.

Architecture

The hardest decision: surviving the rate limit without lying about the chain

The whole system wants to read the chain constantly — leaderboards, staking, LP positions, swap analytics — but the public Algorand indexer/node provider (Nodely) rate-limits you, and a naïve "just poll the indexer" design hits the ceiling immediately and starts failing reads. The tempting shortcut is to treat the database as authoritative and stop reading the chain. On a system wired to public tokens and public liquidity pools, that drifts the moment someone trades outside the app.

So I kept the chain as the source of truth but made reading it sustainable: I cut and cached the on-chain calls instead of trusting the DB. Concretely — multi-layer Bottleneck limiters in front of every algod/indexer call, in-memory and Redis caches with freshness windows, processed-item dedup so a cycle never re-fetches what it already has, batch delays and backoff between calls, and reconciliation jobs that recompute idempotently so a missed or throttled cycle self-heals on the next run. The tradeoff is a freshness window and more moving parts, accepted in exchange for correctness I can defend and a system that doesn't fall over when the provider throttles it.

The systems inside it

• Deep anti-cheat. Score-velocity limits, per-session time caps, score-pattern detection, daily earning caps, NFT re-verification at payout (you can't cash out points for an NFT you no longer hold), banned-funder propagation (wallets funded by a banned account inherit suspicion), and a hardcoded exploit list — layered so a cheat has to beat all of them before points become tokens.
• Reward streams, many. NFT soft-staking (rarity-weighted), token soft-staking (a probability ladder), leaderboard pools, a spinning wheel, missions, and the Burnfire burn/accumulate pool — each with its own accrual and payout rules.
• LP rewards across DEXes. The FAMverse distributor auto-discovers liquidity positions across Tinyman V1/V2, Pact, Humble, and AlgoFi, plus DDAO LP, and pays providers — with LP leaderboards ranking them.
• Airdrops, every flavor. Trait-weighted airdrops, NFD-segment airdrops, and "smart" airdrops that pay LP holders by their FAM/DDAO-equivalent value (priced via Vestige) — so a drop can target real economic stake, not just a wallet list.
• Swap + liquidity analytics. Parses HAYSTACK swaps and pool activity straight from the indexer to compute live metrics and fire whale-swap alerts to Discord when a trade crosses a threshold.
• ARC-19 NFT mint. A sibling service, pigeon-puffs-mint, batch-mints up to 2,000 ARC-19 NFTs with resume/checkpoint (survives interruption mid-batch), pinning art to IPFS via Pinata, encoding the CID into the ASA reserve address, with an image-integrity hash check.

Results

• 442 commits (853 all-branch), sole backend author, ~18 months, still very active on mainnet — plus the pigeon-puffs-mint service (28 commits).
• 48 models · 17 controllers · ~120 endpoints, a multi-DEX LP-reward engine, a layered anti-cheat system, and indexer-driven analytics — all behind a cache + rate-limit layer built to survive provider throttling.
• The FAMverse distributor moved 79,346.66 FAM to 539 recipients across 567 transactions in a single cycle — concrete on-chain throughput, not a vanity metric.

What this demonstrates

Treating the blockchain as the system of record while keeping it operable: indexer-driven analytics and rewards that stay correct under aggressive rate limits (caching, limiters, dedup, idempotent reconciliation), a real anti-cheat system guarding a value-paying game, multi-DEX DeFi integration, and standards-correct ARC-19 minting — a P2E economy held together by backend discipline.