Krypto

What it does

Krypto is a practice trading account. No real money is involved at any point.

• Markets. A searchable table of the top 100 coins from CoinGecko, refreshed every 60 seconds, with a detail view and a seven-day chart for each coin.
• Wallet. Every account starts with $10,000 in simulated cash. You buy and sell at the live price, and the app keeps a ledger of your last 50 transactions.
• Valuation. Wallet value is cash plus each holding at its live price. Average cost is the dollars spent on a coin divided by the amount bought.
• Portfolio and watchlist. Track holdings you enter by hand against the price you paid, with profit and loss in dollars and as a percentage, and star coins to follow.
• Leaderboard. Ranks up to 100 accounts by cash plus holdings at current prices.
• Extras. A daily $500 bonus, and predictions that stake simulated cash on whether a price will rise or fall.

How it is built

1. A hosted backend instead of my own server. Accounts, watchlists and wallets are stored in Back4App, a hosted Parse backend, and the app talks to its REST API. That gave me sign-up, login and storage without running a server. The cost is that the trading logic runs in the browser, which is the main limitation below.
2. A market data API that needs no key. Prices and charts come from CoinGecko’s public endpoints, so there is no market data key to protect. The cost is rate limits and no guarantee of service.
3. One HTML file with one pinned library. Chart.js is the only dependency. It loads from a CDN with a subresource integrity hash, so the browser refuses the file if it has been altered.
4. Simulated funds only. An earlier version could connect a real crypto wallet and quote token swaps. That code has been removed; the app now deals only in simulated money.

Security and data handling

• Everything that comes from another user or a third party is escaped before it is shown: usernames, coin names, headlines and links. The first version did not do this on the leaderboard, so a username containing markup would have run as code for every visitor. That is fixed.
• Links and images from third-party data are only used if they are http or https URLs.
• Passwords go to Back4App over HTTPS and are never stored by the app. The session token is kept in the browser’s storage.
• The Back4App application ID and REST key in the page are client identifiers and are public by design. What protects the data is the permission rules on the backend.

Known limitations

• The app trusts the browser. Trades, the daily bonus and prediction payouts are calculated on the client and then written to the backend. Anyone willing to edit a request can change their own balance, so the leaderboard can be gamed.
• The daily bonus and open predictions are tracked in the browser’s storage, so clearing it resets them.
• There is no guest mode. You have to create an account to see anything past the login screen.
• The news page depends on sources that are often unavailable, and then shows a fallback message.
• Failed price requests are not retried or cached.
• The tile labelled “24h P&L” shows profit and loss since purchase, not over 24 hours.
• Logging out clears the session in the browser but does not end it on the server.

What I would change

• Move trades, bonuses and payouts into server-side code, so the backend calculates balances and the client only asks.
• Tighten the backend’s permission rules so each wallet can be changed only by its owner.
• Add a read-only guest view so the app can be seen without signing up.
• Cache the last good prices and retry failed requests.