Quote from: Betcoin.AG on Today at 02:20:12 PM

Quote from: TwitchySeal on Today at 03:50:15 AM

It looks like the onetouch games are provably fair, but the playbetr dice game is not for 2 reasons:

1) As others have recently said, there's no explanation on how the result is determined from hashing (256 or 512?) the server seed and player seed. For example, for this bet: https://www.betcoin.ag/transaction/59942673

Hashed server seed: 50f107cf159cddcd327dac23bddb8c4b0bdc545d5ed2514acce4652bf46b8462
Server seed: d61876a22c06d144dae10d8e2fcbb79ea1c98b0afa9bf87f03c0de16609e035b
Client seed: twitchyseed
Result: 29.15

hmac-512(server seed, player seed) returns this string: cd4a384abce5a10ca201bf1017c39200985f44caf5f8b3b5785a8fafe8a6f61bac356a4285f7817 40b944616ecab84c9569bf5e26caac872fddf70b05a562e24

You have to explain how you get 42.47 from that string. provablyfair.co doesn't explain anything so it's not any help. Most dice sites do something like take the first 5 characters of the string and convert them to a decimal. I tried a few other sites methods without success so you must be doing something different (or I could've screwed something up).

2) You aren't using the server seed that you hash and provide before the bet. This defeats the entire purpose of provably fair since you can't prove that the server seed was determined before the bet was made.

I took a screen shot before making the bet from the example above:

You're not using the seed that's hashed and displayed under Next Round. The actual hashed server seed for the next round was 50f107cf159cddcd327dac23bddb8c4b0bdc545d5ed2514acce4652bf46b8462. I did this several times and the Next Round Hashed Server Seed was never used in the next round.

Providing the hashed server seed before the round proves that you didn't change it before knowing what my bet would be.

I'm don't know much php but in the code you posted, if that's the order the functions are executing then you're setting serverSeed and hashing it aftergetting clientSeed (the player seed). For it to be provably fair you have to prove that serverSeed was set before fetching clientSeed.

Code:

$provable = Gamebetr\Provable::init()
// returns an instance of Gamebetr\Provable
setClientSeed(string $clientSeed = null)
This sets the client seed. If no seed is provided, one will be automatically generated. The Provable instance is returned allowing you to chain commands.

getClientSeed()
This returns the current client seed.

setServerSeed(string $serverSeed = null)
This sets the server seed. If no seed is provided, one will be automatically generated. The Provable instance is returned allowing you to chain commands.

getServerSeed()
This returns the current server seed.

getHashedServerSeed()
This returns the hashed version of the server seed.

Also, it's impossible to copy the Next Round Hashed Server Seed. The copy button doesn't work, can't right click/ctrl + v/etc and it's in an i-frame so I can't even access the html to copy it. It does let me paste in the server seed field though...weird.

Edit: I checked the provably fair playbtr roulette and it's using the hashed seed that's displayed for next round - so it's just the dice game with that's not using it.

This is excellent feedback. Exactly what we were looking for when we made our feedback thread. We will report this matter and have it resolved as soon as possible.

We always welcome excellent feedback and we have shared this information with the provider and are expecting an update on this by end of the week.

Thank you.