Thanks Dooglus for writing that up, you do a great job at explaining things.
2) Also how are the odds of X multiplier to appear are calculated ?
The odds are derived from the function that converts a hash to a bust point. So if you're a programmer, by far the easiest way is to write a loop that generates a million random hashes and computes the bust of them. Count how many are >= X, and divide by a million. Assuming X is not too big, you'll have a very good estimate without needing to trust any maths.
In untested psuedo-code:
var count = 0;
for (var i = 0; i < 1e6, ++i) {
var hash = sha265(i);
if (crashPointFromHash(hash) >= 2)
++count;
}
console.log('The game gets to 2x ', count/1e4, '% of the time);
Which should output something like "The game gets to 2x 49.256% of the time" (and if you add the bonuses, you'll see the house edge is a little under 0.5% in this case)
there is a method used by jackpot sites in the cs:go community where they used a secret string + a random generated number into a hash. they publish the hash and the secret before the game ends, once the game concludes you can take the winning number and the secret string and hash to check if it matches the hash that was published.
I can understand that this method is weak because you need to trust the site owners to generate true random numbers and strings.
Lots of times people suggest to me using things like this, where everyone has a client seed (or something like that) and they're all mixed together, and a result is formed. But in general, that would allow me to easily cheat if I controlled one of the accounts (and no one would have any way of knowing if i did).
The bustabit provably fair system is actually quite elegant, and I haven't seen anything that I'd consider better or an improvement on it =)