DEV Community

Betkyo Research
Betkyo Research

Posted on AI-assisted

"Provably fair" is a claim about one function. Here is what it does and doesn't cover

#security #cryptography #webdev #cryptocurrency

Every crypto casino says "provably fair". After the Stake hack of September 2023 — about $41 million out of hot wallets in minutes, games untouched, FBI naming Lazarus a few days later — it is worth being precise about what the phrase proves, because it is a claim about exactly one function and nothing else.

The function is a commitment scheme. Before you bet, the server publishes hash(serverSeed). You contribute a clientSeed. Each round derives its result from (serverSeed, clientSeed, nonce) through a public algorithm. When the server seed rotates, the old one is revealed, and you check two things: that it hashes to the commitment you saw, and that re-running the public derivation reproduces every result you were paid on.

import hashlib, hmac

def result(server_seed: str, client_seed: str, nonce: int) -> float:
    digest = hmac.new(server_seed.encode(), f"{client_seed}:{nonce}".encode(), hashlib.sha256).hexdigest()
    return int(digest[:8], 16) / 0x100000000   # uniform in [0, 1)

# after rotation:
assert hashlib.sha256(server_seed.encode()).hexdigest() == committed_hash
assert result(server_seed, client_seed, 17) == what_the_site_paid_on_round_17
Enter fullscreen mode Exit fullscreen mode

(The exact derivation differs per site — ours is published with each game — but the shape is always this.)

What that proves, if both asserts pass:

  • The house could not have chosen this round's result after seeing your bet. The seed was fixed before you played.
  • The house did not pay you on a different result than the one the seed produced.
  • Across the whole seed's life, the results were what the algorithm says, so the house edge was the published one.

What it does not prove — and what no amount of hashing can prove:

  • That the site is solvent. The commitment is about results, not balances.
  • That your balance can be spent only by you. Custody is a question of keys, signing services and who has access to them. Stake's games verified perfectly on the day its signing service signed for a stranger.
  • That the client seed you see is the one used. You should set it yourself; a default you did not choose is still fair but gives you nothing to check against.
  • That tomorrow's seed will be honest. Each commitment covers one seed's lifetime. Verification is something you keep doing, not something you did once.

So the sentence "the games are provably fair" has a precise truth value you can check with a dozen lines of Python, and the sentence "your money is safe" has none you can check at all. The second is a trust decision, and the only lever you hold on it is exposure: what you leave on a site is a loan to its hot wallet.

Longer version, with the Stake timeline and the FBI attribution: https://betkyo.com/en/blog/the-stake-hack-41-million-in-nine-hours-and-the-vault-provably-fair-does-not-cover/

Top comments (0)