Fairness
Provably fair
Each session commits to its server seed before play; any round can be recomputed from the revealed seed and the published lookup table.
Each session has a server seed whose SHA-256 is shown at launch (server_seed_hash), the SHA-256 of the next server seed (shown before the player picks a client seed for it), a client seed, and a nonce that counts the rounds played with the current seed. The aggregator cannot set the client seed.
A round's outcome
for k = 0, 1, ...:
h = HMAC-SHA256(key = server seed, message = "<client seed>:<nonce>:<MODE>:<k>")
x = first 8 bytes of h, unsigned big-endian
if x < 2^64 - (2^64 mod total): r = x mod total, stop
book = first row of the mode's lookup table whose running weight sum exceeds rThe player's session#
POST
/fair/statePOST
/fair/roundsPOST
/fair/rotatePOST
/fair/reveal| Call | What it does |
|---|---|
| /fair/state | rotation, server_seed_hash, next_server_seed_hash, client_seed, nonce |
| /fair/rounds | The last 50 rounds, except one whose bet the wallet has not confirmed yet |
| /fair/rotate {client_seed} | Moves to the committed next seed with a client seed of the player's choice and reveals the seed just retired |
| /fair/reveal {rotation} | Reveals any retired seed again |
Seeds are not in the database
Server seeds are derived from a key kept outside the database (HMAC-SHA256(key, "<session id>:<rotation>")), so neither the database nor its dumps can tell an outcome ahead of play. Ask us for the verifier script that recomputes a round from a revealed seed and the lookup table.