Project 02
LastRound
Real-money skill-based esports tournament platform — full payment lifecycle, KYC, brackets, and dispute resolution.
- Client
- An esports start-up, pre-launch
- Built with
- Next.js · Supabase · Authorize.net · Didit
What we built
A real-money tournament platform for competitive gaming (client project, pre-launch). Players deposit funds, enter skill-based tournaments, and withdraw winnings — which means the platform is, underneath, a payments and compliance system with a game attached.
Built end-to-end: deposits through Authorize.net Accept Hosted, a full-page redirect so no card data ever touches the app's origin; idempotent deposit fulfilment with a reconciliation path that recovers missed or failed confirmations; identity verification (KYC) through Didit gating withdrawals; a manual, admin-approved payout queue for launch; tournament brackets with automatic advancement; and a dispute-resolution flow with evidence upload.
Money paths are built to be safe under retries and attack: request handling is idempotent, payment and identity webhooks are protected by replay guards, and the database layer was audited for privilege escalation and insecure direct object references.
The payment and KYC layers are provider-agnostic. The platform previously ran Stripe and PayPal integrations and currently runs on Authorize.net and Didit.
- Authorize.net Accept Hosted deposits: full-page redirect, no card data on the app's origin
- Didit identity verification before any withdrawal, with payouts through an admin-approved queue
- Idempotent request handling, webhook replay guards and a database audited for privilege escalation and IDOR
Players, tournaments and amounts in these screenshots are sample data from pre-launch testing.
