Post
Topic
Board Gambling
Re: BTC-Raffle.com Raffle's every 30 seconds Provably Fair
by
jlfvr
on 17/12/2015, 14:04:38 UTC
This game is not provably fair and you are misleading your players by claiming it is.

Granted, by displaying the salted and hashed result before the game ends, you prove that the winning ticket (the "lucky number") was not changed based on subsequent wagers by players. However, there is no way for players to verify that the house isn't posing as other players. These fake players would have an obvious advantage since they know which games to enter and when to do so in order to win the pot with a high likelihood, thereby cheating the real players.

Consider this example:

  • Player A purchases a ticket and the hash 5041f376ddcb15642ffecea159db207945c0dc0f8375fb9c4657b1b27b6b0e1eb4cd9a138939664 acd254839f15e70fd18e670ac814202aea4b860bd2aa56adb is shown.
  • Players B, C, D and E also purchase a ticket.
  • The game ends and the lucky number 9337 is revealed. Also, the salt 774eb411-8f95-4e65-b0cd-89c19d05f03b is now displayed.

Player D is having a bad run and he's getting suspicious, so he decides to verify the last game. He uses the formula in your FAQ and enters the lucky number and the salt. To his surprise, everything checks out. The hash is correct!

So, nothing to see here? Not quite. The house purposefully generated a lucky number near the end of the spectrum (from 1 to 10.000). After players B, C and D purchased their tickets the house decided that more players were unlikely to join, so it purchased the winning ticket itself, posing as player E, and thereby cheating player D of his winnings.

This is just one attack vector and I imagine a clever (malicious) site operator would be able to come up with more. In any case you cannot reasonably claim that the game is provably fair.