Whitelist badgeronsol.com (false positive — legitimate on-chain game)

[gavunwud]

I'm the owner/developer of badgeronsol.com, a free browser mining game ("Badger's SOL Grid Miner") for the $BDGR community. Players earn cosmetic skins in-game and can optionally mint them as Metaplex Core NFTs from our official collection: 3DacMwWYwsjhqXP9xAZevsvHKVGFjYKrEKijtB9oSeSh (mainnet). All transactions are standard Core create mints, built server-side as collection authority and signed/paid by the user's own wallet — we never request seed phrases, approvals, or token transfers. No presale, no token sale on the site. Media/metadata on Arweave (gateway.irys.xyz). Socials: x.com/badger_launchly, x.com/launchlydotapp, t.me/launchlyapp. Happy to provide anything further to verify ownership.

Summary by CodeRabbit

• New Features
  • Added support for the badgeronsol.com domain alongside the existing nftplus.io domain.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 042b4b24-7489-45a7-aa88-49844e57c8b1

📥 Commits

Reviewing files that changed from the base of the PR and between 5030186 and 0b39bff.

📒 Files selected for processing (1)

• whitelist.yaml

---

📝 Walkthrough

Walkthrough

The whitelist is updated to retain nftplus.io and add badgeronsol.com as an additional allowlisted domain.

Changes

Whitelist Update

Layer / File(s)	Summary
Add allowlisted domain whitelist.yaml	Adds badgeronsol.com after the existing nftplus.io entry.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding badgeronsol.com to the whitelist.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[gavunwud]

Following up on this one. Happy to provide any additional verification of domain ownership that would help.

[gavunwud]

Following up again, and adding some figures since my last comment in case they help the review.

badgeronsol.com has been live 6 weeks now (first run 5 July 2026). In that time:

• 2,152 registered players, 734 with a wallet linked
• 35,791 runs played
• 350 NFTs minted on-chain by 106 distinct wallets, the most recent today
• 680 reward payouts sent to 55 wallets, every one of them confirmed on-chain

None of that needs to be taken on trust, it is all verifiable directly:

Collection (Metaplex Core, mainnet)
3DacMwWYwsjhqXP9xAZevsvHKVGFjYKrEKijtB9oSeSh
https://solscan.io/token/3DacMwWYwsjhqXP9xAZevsvHKVGFjYKrEKijtB9oSeSh

Reward wallet, every payout transfer originates here
https://solscan.io/account/71KmpFzcAkLzf6edAngk2eKVASPJgvZbSyy3Qj9v1xx7

An example of a recent mint
https://solscan.io/token/5TBvjUW7aPxGGjjwPxdUh3ULxKEvWCetWyFGZ3GeCnoW

To restate the security posture, since that is what the listing turns on:
the site never asks for a seed phrase, never requests approvals, and never initiates a transfer out of a user's wallet. The only transaction a player signs is a Metaplex Core create-mint for a cosmetic they already earned by playing, built server-side under the collection authority and paid for by their own wallet. Rewards travel the other way, from our wallet to theirs. There is no presale and no token sale on the site.

The practical effect of the current listing is that players hit a red warning screen when they open the game, and we are answering questions about it in our community daily. That is hard to address when the flag appears to be an automated false positive.

Happy to provide further proof of domain ownership, a signed message from the collection authority, or anything else that would help. Thanks for your time.