Bitcoin Forum

Edit of my edit:  I think this is an entertaining thread.  It starts with a discussion of how a Bitcoin Lottery could be run. After several messages, in message #4, a user who runs a lottery claims that it is cheat-proof, and bets his entire BTC fortune that I can't think of a way that he can pay himself without everybody noticing.

I proceed to give a method of how he can do that.  Some people agree and others disagree. 
Don't misunderstand me, I'm not accusing him of any wrong-doing; I'm wondering what consensus opinion is.

But it does bring up an interesting dilemma.

If someone runs a betting site, and he loses a very public bet in a forum and fails to pay up, can you trust his betting site?


A provably honest lottery site could be one that bet on the hash of an upcoming Block.  The Hex value of the Block Hash (or the last few digits) could be bet upon.  If you can name the last hex digit of block 131300 (or some future block, 2 blocks into the future), you get a 15 to 1 payback on your bet.  Name the last 2 hex digits, and get a 250 to 1 payback.  Bet correctly that a certain 3-digit sequence will appear somewhere in the Block Hash, leading zeros excluded, and you get $250 (or whatever makes it a near fair bet).

People can see payments into the lottery in the BlockExplorer, and can see payments out (which should be predictable, odds-wise).

You could even make it provably honest as a para-mutual, growing bet (like Power Ball or MegaMillions).  You buy a "lottery ticket", and your lowest numerical payment address recorded in the transaction is your entry.  If your payment address, written in hex, has its last N hex digits matching the Block hash, you win.  Otherwise the jackpot grows.  Users can watch BlockExplorer to verify that previous payouts were made.  (Of course, you can never prove that the Lottery Company won't run off on this next bet....)


The only real issues that I see with this are if there's a chain split.  So maybe payouts are delayed by a day to help fight that case.



Somebody get to work on this!

EDIT:
"If someone runs a betting site, and he loses a very public bet in a forum and fails to pay up, can you trust his betting site?"
If that makes you wonder just read the whole thread. (I hate editing my posts but I feel forced because the initial post was edited to make it appear like I can't be trusted) Bet was not lost!  ;)


Done. Have you seen bitlotto.com? TAABL also did something similar a while ago. There is also btclottery.com. The reason I didn't go with just block hashes are because a powerful miner could increase his odds a tiny bit by not submitting a block. Everything I do can be monitored with blockexplorer and it's impossible for me or any of the players to cheat. The winner is beyond my control.

Jackpot for July 6 will probably be worth over 1,000 USD.

I looked at bitlotto.com, and it doesn't look anything like what I described.  Maybe I am missing something.

Tell me again how it's provably honest?
More specifically, tell me how I as a potential lottery ticket buyer can make sure that the lottery has paid out to a real lottery ticket holder, and not a shill?  (Maybe you bought a ticket under some other wallet, and simply paid yourself, for instance.)

Not trying to make a false accusation, but I failed to see that "provability" with a quick scan of the bitlotto.com page.

-All payments go to the same address: eg. http://blockexplorer.com/address/1D9c6qLKRjxh7xbyv6MBUcBFJHDFeDQpsg
-all .25 payments can be verified (some bought for 1 btc before big BTC price changes - tickets still valid and .75 returned- check their addresses and you can see .75 payment from me)
-each transaction has a unique hash - can't change it as it's part of Bitcoin blockchain
-total jackpot size can be verified by adding .25 tickets or looking at received BTC in blockexplorer (accounting for a few who over paid)
-draw then ends - tickets are all set in stone in the block chain each with a unique hash
-winner is determined by a hash of block hash + mega millions numbers to prevent a miner trying to increase odds by not submitting a block if it doesn't work for them -the hash is totally unpredictable and impossible to manipulate unless you can manipulate the USA mega millions lottery (impossible)
-using a set algorithm the winner is determined based on their payment hash (method is set and can't change)
-payment can only go to the person who sent the ticket -look at blockexplorer and payment can only go to that address -that's why using Bitcoin on their own computer is so important. I can not send to any other address!!
-there is no way I can cheat!!!

It's cheat proof. If you can think of a way I can pay myself without everyone noticing I'll give you all the BTC I own!!

Oh, and I was just checking your website. Interesting! Perhaps I may use your site as a alternate link for my lottery addresses! What kind of security do you use for the addresses? (I worry that someone would hack the link and change it so payments go somewhere else).

Well, I feel stupid, because your lottery is pretty much exactly what I described! ha!

But, since you are offering me ALL of your BTC, I'll go ahead and claim those here.  Send them on over to me, or tell me why I am wrong:

Here's how I think you could cheat.

For every entry that you get, create 1000 entries of your own.  Entering the lottery essentially costs you nothing, as you are simply moving the money from one pocket to the other (and freezing it until the lottery date).

Now you have overwhelming odds of winning, at essentially zero cost.  As the jackpots get larger and larger, it gains attention and gets more entries.  And you make more money. And then you can afford to increase your investment, and increase your odds to near certainty.

And, if that 1 in a thousand case does eventually happen, then you just pack it up and disappear.  And open bitlotto2.


OK, send me all your Bitcoins.  Or tell me how I am wrong.
Judges?  Am I right here?  Did I just win all his Bitcoins?

(Really, I believe that you are honest, but for all I know, in the June 1 lottery, you had just 1 Bitcoin worth of real entrants, and ~130 fake entrants that you created.  You won (surprise), and the jackpot looks attractive for the next round of suckers.)

A valid concern.
I'm not aiming for bank level security at this time.   At Beta release, I was just aiming for being better and easier than putting your Bitcoin Address in to your signature.  (Anyone who puts their address in their signature is also running the same risk - that the Forum owners will change it.)

I have a lot of plans for this site.  If people begin to depend on it, I'll probably put in "locking" mechanisms so that in order to change the address, you have to unlock it via an email link.  And then put in monitoring mechanisms from a separate machine that would also need to be compromised.  Someone suggested a photo, so you could have a photo of you holding your Address.

Those are all ideas, but really the shortname idea is just sort of a precursor of another project that I am working on.

LOL. BUT the transactions would would show where the payment came from. I couldn't just pay from the pool back into the pool. I can't just move the money around. It would show up as me moving money out of the account for another reason other than payment of some winner. If I moved money to a certain address I would have to actually spend that money. I'd be on equal terms with everyone else.

yeah, that's why I said "freezing the money till the lottery date".
Edit:  Yes, you would have to "spend the money", but you are only paying yourself.  In reality, all you need to do is take some of your savings and "spend it" by moving it to the lottery account, knowing that you will get it all back on June 1.


Is there a way for me to be able to tell that you didn't buy 99% of the tickets in the June 1 raffle?
You are NOT on equal terms with everyone else, because a) you are holding the money (and could be a flight risk if you lose), and b) you get to keep 1%.

I stand by my claim that you owe me all your BTC.  Please tell me that it's $500K worth!   ;)

"If you can think of a way I can pay myself without everyone noticing"  - And I'm certain you understand -cheating!
If I paid 99% of tickets I'd have to use my own money. I'd be on the same terms as everyone else. I can't use the money in the pool as it would show up as me taking money out! The 1% is known and makes sense as per my details. Flight risk? Ok, I didn't mean steal but cheat. Yes I could not pay or pay the wrong person but everyone would know! It's in my best interest to run the most cheat proof honest system. I could take the money but I'd be better off running an honest lottery the rest of my life!!!

I repeat.  No you are NOT on the same terms as everyone else.

If all the money were held in a trusted independent escrow, THEN you'd be on the same terms as everybody else.

Somehow I feel that I am not going to collect on this.  I point out a valid security concern, and I am not going to get rewarded.  :(

Your challenge was to think of a way you can pay yourself without everyone noticing, yet your own website brags that we can't tell who actually owns the ticket. 
It could be you!

You probably shouldn't have bet me all of your BTC, or you'd be comfortable admitting that this is a hole that you should fill.  As I recently read on a website:


Sorry, I'm in a feisty mood tonight, but I think I have you on this one.

Sure it could be me. My odds are the same as everyone else. When I said "If you can think of a way I can pay myself without everyone noticing I'll give you all the BTC I own!!" I meant a way I could pay myself UNFAIRLY and be UNNOTICED. If I play I could win. My odds would be the same as everyone else. It wasn't if you could think of a scenario where I could win. A truly anonymous and un-cheatable lottery could be won be it's own creator. Escrow does nothing. You always have to rely on someone to sent the payment. That's why with time I hope the trust grows. The trust is needed for the payment not how the lottery runs. I'll always pay because it's in my own self interest.

Come on, it's late, when I said:
If you can think of a way I can pay myself without everyone noticing I'll give you all the BTC I own!!
I was meaning:
If you can think of a way I can pay myself *UNFAIRLY* without everyone noticing I'll give you all the BTC I own!!

Of course I could play my own lottery. BUT I wouldn't be able to CHEAT!!

Trusted escrow mitigates the flight risk.  Without it, you can stack the odds against all other participants, and nearly guarantee a victory with the only downside being that you have to go out of business if the highly improbable happens. 

With trusted escrow, you are in the same boat as the other participants, with the exception that your tickets only cost you 99 cents on the dollar.  In other words, you have better odds for the same amount of money.

Hey, I'm willing to "settle out of court" on this.  What do you think is fair for my security advice?   :)

I'd be more than happy having some type of escrow but no matter what you always depend on someone to finalize the payment. I'd rather it be me than someone else I don't know. With time people will see I'm trustworthy. The games are public and can be verified! If I can set an escrow beyond my control I will. I'm open to suggestions! I just don't know how I'd do it without people who lose somehow locking the money up.

My whole point is: I can't CHEAT and make myself the winner more than anyone else. *IF* I cheat everyone would know!! That's the point. Not that I get 1% or that I finalize the payment. I can't CHANGE THE RESULTS TO MAKE MYSELF WIN!

"I'd rather it be me than someone else I don't know."

You'd rather it be you, of course.  I'd rather it be someone who is trusted.  And I'd rather it be someone who doesn't have a stake in the game.  Gavin offers ClearCoin Escrow, and he seems to be someone that many people trust.

I'm really not trying to be a jerk here, but this whole thread is about running a trustworthy betting site, and you made a bet and lost, and are showing your level of trustworthiness.  You really have few options at this point, because you and your site's reputation is at stake.  If you make a very public bet, and lose (and if most people agree that you lost), and you don't pay, then why would they trust your site?

We can take this conversation offline if you prefer, but I think your reputation is at stake here.

As an independent observer (who will probably regret posting in this thread):

jerfelix you did not win any bet. bitlotto was asking if there was a way he could undetectably cheat at the lottery. You did not provide a solution to this.

As for escrows why should bitlotto be any less reliable than any other escrow provider?

The solution is simple. If you don't trust bitlotto for whatever reason, don't play his lottery!

Thanks for an independent opinion.

I believe that he could have undetectably cheated on the June 1 lotto, simply by the method that I described.  He could have stacked the odds in his favor, and came up the winner, and taken some small amount of Bitcoins from the betters.  And he could have been prepared to fold if he didn't win.

How can you prove that he didn't do that?  I know you can "produce the winner in person", but you can't prove that the winner wasn't a shill.

Therefore, I am not only claiming that he COULD undetectably cheat, but that he MAY HAVE ALREADY cheated.  If you can prove that he hasn't, you will make your case.  But so far no one has give me any way to prove that he hasn't.  And since (I believe) no one can absolutely prove that he hasn't, then clearly he CAN. and so I still claim to have won the bet.

Feel free to prove me wrong.  Don't regret participating in spirited conversation!  This is fun stuff!

PS. I'm not so greedy that I would demand a fortune in Bitcoins on a flip bet.  It's just an interesting dilemma.

I will try to implement this hash thing on my small lottery site, too. I hope I will find some time at the weekend to set up the described method.

anyway I would like to say that my lottery uses standard rand(0,100) and I don't cheat. Maybe a look at the win loss list can prove that a little bit. -> http://bitcoin.dyndns.info/bt/
As you see I use instant payout, so all winners get their profit directly.

But I agree with you, I need that kind of system, too.

Kind regards!

I suggested a TRUSTED escrow as a way to avoid the possibility of the lottery site cheating.  The reason this is important is because of exactly the scenario I posed.  The lottery site could have a very real stake in the game.  The whole lottery could be a scam.  By working with a trusted escrow, it would force a crooked lottery site who wants to take a heavy stake in the lottery to have to really put up the money.  It reduces the possibility that the scam lottery site will run off with all the money, in the unlikely event that he loses.


No, you are misunderstanding the problem.  The problem is, how do you set up a "provably honest" lottery?  The solution to that is to do a lot of the things that bitlotto did, plus add a trusted escrow.  And continue to ask people to shoot holes in the method of the lottery.

Actually I trust bitlotto, and I'm enjoying a spirited debate here.  But that doesn't mean that I didn't win the bet!

bitlotto wins, jer pay up.

jereflix did not offer a way bitlotto can cheat and thus can't claim the bet.

However, he did implicitly offer a way bitlotto can inflate his apparent trust regarding stealing. Consider again this scenario:

Disregarding fees, bitlotto puts 130 of his own BTC for a chance of 130/131 to get back 131 BTC and 1/131 chance to lose it all (just like anyone else could). However, it could be that his strategy was really as follows: If he wins, pay out to the winning address normally; if he loses, take the money and run. This way he can make himself appear worthy to be trusted with 131 BTC when he actually is not.

Wow, 0-3.

I have nothing to pay.  I didn't bet anything.

But I am still awaiting proof that he didn't buy the majority of the tickets in the June 1 lottery.  Until you can prove that to me, I contend that he could have.  And since he could have, that proves that I won.


Thank you, that was my point!!

Edit:
Furthermore, in that  hypothetical scenario, he CHEATED the users out of the 1 BTC, because they had NO chance of winning.  zero.  zip.  nada.   130/131 they lose.  1/131 they get no payout because he runs off with the money.  That is a way to cheat.  and that is proof that I won the bet.

I don't know if this is clear to anyone else but me, but when someone writes:
"It's cheat proof. If you can think of a way I can pay myself without everyone noticing I'll give you all the BTC I own!! "
I take it to clearly mean: "I have a lot of faith in my system" and nothing more. He's communicating an idea, not making a formal bet. The language is too informal for to be taken seriously that way (note the multiple !). All language should be taken in the spirit of its meaning, otherwise all communication would be constantly bogged down with mindless details and we'd all talk like lawyers.

I believe the term for this is "pedantic".

Regards

Nobody can prove that*, he could have, and it doesn't prove you won. The bet was about stealing the money without being detected. He might have an intention to steal at some point and plan with this intention, but the moment he steals he'll be detected.

* Unless buyers of the majority of tickets come and supply proofs of their identities.

I guess there was some scope to clarify the exact terms of the bet in advance. But to me this doesn't seem to qualify because 1) He can materially steal only once, which was clearly known to be true and 2) While he can statistically steal several times, the scope of this cheat is bounded by his capital and thus he can't do a large-scale scam.

I'm with jerfelix.

Forget bitcoin.

I am a millionaire.  I start a lottery with odds of one million to one to win whatever gets put in the pot.

One person plays my lottery.  The pot is $1.  They have a million to one chance of winning.  If they don't win, it rolls over to next time.

A million people play my lottery.  The pot is $1million.  They each have a million to one chance of winning, but on average, one person will win (assuming a uniform distribution of tickets).

The above two examples are identical if we play an infinite number of lotteries.

Now a million people play my lottery.  But I also play my lottery, buying an entirely even spread of tickets, covering every possibility.  The pot is $2million.  I am guaranteed to be one of the winners; and there is likely to be one other winner.  We each get half the pot.  I get my million back.  Fine -- a million in, a million out.

Now go again, but this time I, as operator, take a cut of the pot (as is normal in lotteries).  For the sake of simplicity we'll say 50%, but it doesn't matter.

The difference now is that for an outside player, guaranteeing a win costs them $1million, and they only get half of it back when they win.  For me to guarantee a win costs me $1million and I get all of it back.  That means I can play every time at zero cost, and guarantee a win.  Other players are guaranteed to lose money; and depending on how many play, I get their money too.  On average, I will come out on top.

Unless the operator percentage is zero; lottery operators shouldn't be allowed to play their own lottery.

I don't know the details of bitlotto; but if there is any percentage taken, then the operator playing manipulates the payout.

I don't think talking about "doing a runner" is relevant, because that can be done whatever the rules are.  I also don't think "I haven't done a runner yet" is proof of trustworthiness.  What if your personal threshold for theft is $1million; well you are trustworthy up to that point then aren't you?  For outsiders to trust, the person who holds the pot should not be able to benefit from the pot.  The means escrow, with release controlled by an independent non-player.

I'm confused.  You say "The bet was about stealing the money without being detected", which I agree.  And I said he very well could have cheated 1 BTC from some poor sap, without being detected in the June 1 lottery, and you agreed that nobody can prove that he didn't*.  So why didn't I win the bet then?

* And even if the majority of ticket holders supply proofs, you cannot tell whether one or all of them are shills.


I'm going to be hard to convince, so this could go on forever, unfortunately.  But as I said, I'm not after the money.  I think it's an interesting discussion (and I hate being wrong!)  :)

His system seems fairly cheat-resilient to me.
Stacking the odds is part of the game. Anyone can do it. The betting address being public, he doesn't have more information than anyone else on what the odds are.

The public address serves as a transparent escrow: anyone can see what goes in, and what goes out. It's actually more transparent than any other escrow we could think of, at the cost of privacy.

edit:
@realnowhereman: you wrote "guaranteeing a win costs them $1million, and they only get half of it back when they win".
If an outsider do what the operator do in your story, buy 1 million tickets evenly spread (in addition to the 1 million people already playing) the total jackpot is now 2 millions, so the outsider also get his million back. A million in, a million out. No ?

@realnowhereman - I can see how this logic applies when there is a very small number of lottery outcomes, but does it really hold up when there are 2^256? There's no way for the operator to have 0 risk then.

And in either case it doesn't seem relevant. It's great for the operator that he can profit out of it, but what we care about is the participant. And he can know exactly what his expected payout per lottery ticket is, no matter how the operator chooses to enter his own lottery.

Saying that an operator shouldn't have an edge when playing his own lottery is like saying a grocery store owner shouldn't buy groceries at his own store.

bitlotto can cheat him statistically. That is, he can have a plan to make sure the participant doesn't win even when he should. But this is different from material cheating (not sure if this is the right word), which means that the contingency that the participant should win actually happened and he still didn't get the reward. The latter cannot be done undetected.

And I guess there's no real way to be convinced whether the original bet was about material cheating or also limited-scope statistical cheating.

Well, Bitlotto is set up with a system that you can generally describe as "whomever is closest to the number drawn wins" method.
And by flooding the pool of entries, he can "sneak in front of" the "real winner".  Like if the winning number was 123... and the closest legitimate ticket was 119... but by flooding the entries, the lottery administrator got the number 120..., the legitimate winner would not know he's the legitimate winner, because he could see some other entrant that is closer than he is.

I agree, if he admits that someone won, you can see if he pays out.  That's real cool.

With 130 entrants last month, if 40 were legit, and he bought the other 90 using the plan I outlined, then he had about a 69% chance of winning, and all it takes is about $1800 and some reasonable luck, to get to keep $800.  (And if he lost, he keeps it anyway, but has to shut down.)

That very well could have happened, and I'd say that $800 is materially cheating.

I really think he's running an honest lottery, so don't misinterpret what I am saying.  I'm just trying to figure out how anyone can be 100% sure.

I've obviously not been clear.

The operator being able to buy at half price gives him an advantage.  It's not like the grocer, because when a grocer buys his own banana, he can't then sell that banana, so he has lost his profit.  A lottery operator has close to zero marginal costs to sell himself an additional ticket.  He is not depriving himself of the ability to sell a ticket to a customer.  Lottery tickets are generated from thin air.

Let's think about it in terms of a real lottery.  In the UK the lottery is 14 million to one for the big win.  Therefore if the jackpot is every greater than £14 million; it is a good bet to buy 14 million tickets.  If you did this every time, you would come out on top (we'll assume the behaviour of the other players is unchanged because of the big win, that a roll over is as likely in either case).

Let's say I was a discount seller of lottery tickets, and only you know about me, and can get tickets at 50% off.  You could then make the same good bet for £7 million.

That is the position that the lottery operator is in who buys his own tickets.

I think here the particulars of bitlotto may differ from other lotteries. To generate a ticket for himself he actually has to spend in advance a BTC he currently owns. So whatever he has to gain only scales with his own capital, not with the number of participants.

- And this sounds a lot less impressive if the fee is only 1%, and he can get the good bet for £13.86M.
- You're once again making arguments that make sense for a traditional lottery where there are a limited number of options, and not so much for a lottery where there's virtually infinitely many options and exactly one winner (thus there's always a risk to go along with any expected gain).
- This is exactly like the grocer who can get his own good produce for a discount relative to his customers, and can offer a discount to his acquaintances.
- You're still only showing the operator can gain, not that the participants can lose. Every customer who buys a ticket knows he has a 1/X chance to win 0.99X BTC, where the value of X is not yet known. All of your suggested manipulations don't change that.

Well yes; I just plucked 50% out of the air.  But gain is gain.


True; I've not looked at bitlotto at all; but I'm fairly experienced in lottery systems.  I wrote software for a lottery company.


No it's not.  When the grocer purchases his own goods, those goods aren't available for him to sell.  When a lottery operator purchases his own goods, those goods are still available to sell (or at least a perfectly adequate substitute).


For the operator to gain, someone has to lose.  In the closed system of a lottery, one mans profit is another's loss.

You're only half correct, the 1/X chance is the same, but the prize changes.  But the big manipulation is that statistically, a million random purchases do not guarantee a win.  A million purposeful purchases (such as the operator can make) do guarantee a win.

If a million people buy 1,2,3,4,5,6 but the operator buys a million different tickets, the chances of him losing out are very small.

Imagine it's a raffle.  If 10 punters buy tickets they have a one in ten chance of winning.  If the operator then buys one hundred million tickets from himself, he is guaranteed to win.

The little bit I've seen of BitLotto makes it look more like a raffle than a lottery to me, so this problem is even more relevant.

A difference between bitlotto and traditional lotteries is that bitlotto isn't "Progressive" (meaning "growing jackpot" in traditional lotteries, when there are no winners).  In bitlotto, the "closest person wins", so there's always a winner if anyone bet.

I agree with most of what you are saying though (since you seem to be agreeing with me!) 

A lottery site can manipulate the odds by buying tickets from themselves, to the extent that no one else has a reasonable chance of winning (or if they do win, the site runs off with the money).  As Meni Rosenfeld implied, this doesn't scale infinitely, but it most certainly could have been done, and can be done, at the levels that bitlotto is currently running. 

And I believe the best way to plug that loophole is to force the lottery funds to go to a trusted escrow.  This would help to mitigate the possibility that the lottery site can run off with the money, and remove the incentive for the lottery site to buy massive amounts of tickets from themselves.

Only up to the timescale required to order more supplies, which to me seems like a technicality.

I was wrong, but it only strengthens my case. The correct statement is: The customers don't lose, and the operator doesn't gain.

Consider two scenarios:

Scenario A: A million customers each buy a single ticket.
The operator collects a 10K BTC fee.
Each customer paid 1 BTC and has 1/1M chance to win 0.99M, so his expected gain from the bet is -0.01 BTC.

Scenario B: A million customers each buy a single ticket, and the operator buys 1M tickets for himself.
The operator paid 1M. He has 50% chance of winning the entire 2M, and a 50% chance of getting only a 20K fee. Expected gain is 10K BTC, same as before.
Each customer paid 1 BTC and has 1/2M chance to win 1.98M, so his expected gain from the bet is -0.01 BTC.

Because as jerfelix pointed out this lottery is not progressive, there is never an expected gain out of it. Customers pay in expectation to get the rush of high variance. So all the operator can do is get this high variance without paying for it, he cannot gain in expectation.

The X in "1/X chance" and in "0.99X reward" is the same, making the expectation per ticket a constant -0.01 BTC.

In bitlotto's system two different users can't get the same raffle number. And any single user would be silly to buy two tickets with the same number since this gives him no advantage (and he can make sure each ticket is different). So a million ticket bought by users will have a million numbers, just like a million tickets bought by the operator.

In bitlotto's system, he needs to actually have 100M BTC and freeze them until the draw to do this. And anyone else with a spare 100M BTC can do it as well, not just the operator.

:popcorn-eating emoticon:

First of all, bitlotto didn't make a bet. He made a casual statement, which you then took as if it was a binding bet with you, without asking for confirmation and without even making any counter bet. You can't expect him to pay up on something so one-sided as "I'm betting everything against someone who's not betting anything".

Second of all, you didn't win the bet. You keep describing the possibility of the lotto operator buying tickets in the lotto as cheating, when it is nothing of the sort. If someone wants to buy 1 million lotto tickets and stack the odds in their favor, they have every right to do so, even if they are also the operator of the lotto. That's not cheating, that's just aggressive betting. Anyone can do it, whether they run the lotto or not.

Finally you tie together the idea that if he buys 99% of the lotto tickets and then someone in the remaining 1% wins, he could run off with the money. This breaks the very premise of his original statement because it would be very obvious that he was doing so. Everyone would know it, so it would not be undetectable and therefore this method of cheating (simply taking the money and running) doesn't meet the criteria he set forth (that there is no *undetectable* way for him to take money). You are trying to obscure this fact by tying it in with some concept that buying a lot of tickets is cheating, which it is not.

Any bitcoin transactions runs the risk of one party 'taking the money and running'. It's not a weakness of the lotto.

Thanks for all your support other people. Note to self: don't engage in debate late at night, exhausted and drunk.. ;D

About the escrow: I'd love to do it but I don't know if it's possible? Wouldn't the people who lost effectively have to allow the payment to continue? There could be many sore losers. With it being me, trust will come with time. I'll always pay, and people will see that. If I use clearcoin who gives the ok? And wouldn't the trust still have to be with a website or person?

Editing the first post to give the appearance that I'm cheating and dishonest is well... dishonest. Could you please make your posts as they were and let the users read the whole thread and come to their own conclusions? Many will just read what you wrote and move on. I'm honestly trying as hard as I can to be open and transparent and demonstrate that cheating BitLotto is not something I can do! Taking the money and running but not cheating! If I ever stole a jackpot everyone would know and I would welcome the authorities coming after me for I have stolen. Theft is wrong. Simple as that. 

Well, hopefully there's no such thing as bad publicity!  I'm really just having fun in debate.  I have confidence that you run a clean lotto, but like the challenge of trying to prove or disprove it.

I'm not after your BTC, but do feel it was risky to offer such a large bounty to find holes in the system..... especially since it seemed to me and others that I had a good point.

But it's all in fun. :)

First, he certainly made a clear challenge, an offer.  If I do X, he will pay me Y.  If you don't want to call it a bet, that's fine.  But that offer would be as legally binding as any other, like "if you work for an hour, I'll pay you $10."

Second, sure anyone can buy lots of tickets to stack the odds in their favor.  But the lottery owner had the distinct advantage of being able to take the money, win or lose, unless it's in trusted escrow.  So, no, it's incorrect to say that "anyone can do it", because the lottery owner has a HUGE advantage that no one else has.  He can take cash, win or lose.

Finally, your third premise, that it would be obvious to all, if he ran off with the money, this is true, but my point is that such an unscrupulous lottery owner would be cheating everyone on the transactions where he wins.  What you call aggressive betting, I call "can't lose" betting. 

Like I have said before, he may have bought 130 of the 131 tickets in the June lotto, and you can't prove to me otherwise.  And if he did, that's more than "aggressive betting".  It's cheating some people out of 1 BTC.



 

He can't. As far as I understand all the money is sent to a unique public address, thus trackable by anyone through block explorer. Every movement from this address must be to the winner otherwise everybody would know he may have cheated. (which would defeat the "undetected" part of the challenge).




 

He can play with his own money and pay himself like a regular player when he wins.
BUT
If he loses, he has to pay up to the player that won instead, otherwise it would no longer be undetectable, so in my opinion yes, he could have bought 130/131 tickets himself BUT if someone else won he could NOT pay himself instead.

This means anyone playing still has the same chances, no matter if the operator plays or not if the statement is "It's cheat proof.". To cheat would mean taking money if someone who won should have gotten it instead.

You do NOT present a method to beat his system, you are just questioning his trustworthiness. If he really follows the outlined rules, he would not be able to send money to himself instead unnoticed if he didn't win or manipulate the system to make sure only his own tickets can win.

Edit:
^
This would be very noticeable. You don't win.

Of course he can just take the money any time and disappear! The question is, how can he pay himself by cheating ad thus increasing his odds without everyone noticing?

You're being pedantic. You've taken a casual statement and trying to turn it into a legally binding offer. If you really wanted to take him up on that, the intelligent thing to do would be to ask him to confirm the sincerity of the offer. His "offer" lacked any specifics whatsoever so it is hard to take it seriously as "legally binding". You didn't bet anything in return. You just jumped on it and said "Gotcha! Pay up!".


The lottery owner can take the money at any time, if he chooses to be dishonest. But that has nothing to do with buying tickets. You continue to try to tie buying tickets with cheating. The lottery owner, if he chooses to buy tickets, has no advantage over other ticket buyers, since the block explorer makes all bets public and the method for choosing a winner is pre-determined and verifiable.

If the owner of Mt. Gox wanted to run off with all of the money and bitcoins he has been entrusted with, he could do so at any time.  If the operator of any of the public mining pools wanted to suddenly stop paying out and run off with the mined bitcoins, he could do so at any time. It would be criminal, and it would be obvious.

Thank you for confirming that you did not win the supposed bet.


First of all, you are the one making an accusation that he "may have" bought 130 tickets, it is your job to prove your claim, not anyone else's job to disprove it. Block explorer is out there for anyone to view. Why don't you go and look at all of the bets that were made last month and try to connect some of them together?

Second, suppose he did. Out of 131 tickets, he bought 130. That would mean only one other person spent any bitcoins. So he paid himself 130 bitcoins to win 1 bitcoin. Even if you accept that this is cheating, in this scenario he has only cheating *one* person out of *one* bitcoin.

What you are suggesting is that a lottery operator could bet 130 bitcoins in order to win 1 bitcoin. While it may be possible, it would be a very dumb bet.  Nor does it seem like a scenario worth worrying about.  I'd be much more concerned about the pool operators and exchange operators, who are dealing with much larger sums of money, and don't need to outpay their customers 99 to 1 in order to pull off a fraud.
 

You have so many factual errors, I'm not sure where to start.

First, you act as if an agreement requires me to put up some kind of wager.  No, he made a very clear offer to pay for me to complete a task, and I did it.  When you accept a job offer, do you put up something in case you fail to deliver?  "Ok 10K per month sounds good, but I'll pay you 5K if I don't show up for work."  That's ridiculous.  He made an offer, I accepted.  I performed the work.

Second, I am NOT making an accusation that he bought 130 BTC worth of tickets.  I am making the claim that it's possible to cheat.  And I have proven that already, to the point where no one can dispute the possibility that he or his shills could have bought the vast majority of the tickets.  The best you could offer was that it wouldn't be a good investment, which, of course, is no proof.  So I stand by my statement that no one can prove that it didn't happen, so therefore it's proof that the lottery can be cheated and therefore I proved my case.

Third, you are demonstrating that you do not understand his lottery, by claiming that in the 130 to 1 scenario, only one person would be out any money.  In fact, entries are .25 BTC.

Fourth, if I could make nearly 10% annually on my money, with little risk, I'd say that's a really GOOD investment.  It is completely possible for a scammer to set up a lottery, and convince just 4 people per month to enter, and virtually guarantee that you are just taking their money, month after month.  Investing 130 BTC, cheating 4 people to gain 1 BTC per month, with the very small possibility that the scammer might have to "pack it up" - being approximately once every 11 years.  I would say that's a very good return on investment.

Fifth, I never accused bitlotto of running a scam lotto.  In fact, I believe it is legit.  But I think he was being far too risky in putting a challenge out there if he didn't intend to live up to his end of the bargain.  And I believe that if he wants it to eliminate one vector of cheating, he must use trusted edcrow.

Sixth, I gave multiple scenarios - one where a scammer buys 130 BTC worth of tickets, and another where he buys 90 BTC worth.  They have different odds and payouts....  choose the one you like better.  If he had a legitimate pot of 40 BTC, and he had a bankrole of 90, he could take a pretty good chance at  making a much better return on investment.  Having a nearly 70% chance of making 44% return sounds pretty good to me, especially when the downside is that you ALSO make 44% return, but you have to close up shop for a while.

This has some similarities to a well known stock scam, where you prove your worthiness by flooding the pool and playing the odds.
http://totse.info/en/bad_ideas/scams_and_rip_offs/165700.html

You throw out "being pedantic" as if you learned a new word.  In fact, precision in agreements is important, and I'm quite confident that the vast majority of judges in my jurisdiction would agree that the statement made was a binding offer.  They may or may not agree that I met the conditions for payout, but I'm certain they'd agree that a binding offer was made.  You see, pedantry is important in legal analysis.


Once again, I repeat, I am not accusing, and never have accused the guy of running a scam lotto.  My gut feel is that it's legit.  But my contention is that it's not provably honest, and that trusted escrow would move it one step closer.

You haven't proven anything. Me buying tons of tickets is not me cheating but me playing the lottery! Everyone is free to buy as many as they want. Each ticket carries the same odds. Its a RAFFLE style lottery! Obviously if you buy more you have a total better chance of winning. Got spare money? Spent 1,000 BTC and you'll likely win! BUT you could also lose. Same for me. I designed it this way so not even I can get better odds than anyone else. Me buying tickets only increases the pot that OTHER people could win. I can't guarantee a win any better than anyone else.

*If I don't pay the legitimate winner everyone would know*. If I win BitLotto it's because I won! (I don't because of stuff like this thread will happen everywhere!) Even if I show I can't cheat there will be people who don't believe!

I'd LOVE to do escrow. Eventually thought someone has to hit "OK" or "PAY", why add more people that have to be trusted when it can be one? I honestly can't think of reducing the trust to no one. Someone or some site is needed. People risk their money to win big. Part of that risk of course is will I pay. As the game goes one this trust will develop. There is no way around it.

So FAR I haven't had a single complaint of cheating! (other than you of course trying to say it's possible) And that's pretty good I think when we are talking about over 1,000 USD and over 100 players!

Please people calm down  :-*

It would be really great if we could sort this out. Let's forget about the bet/Bitlotto and focus on the lottery architecture.
If we can design a lottery system that can't be manipulated by the operator (except for the obvious run away and disappear for eternity) it would be awesome.

I don't think there is any real world lottery that is so robust that even the operator can play without being accused to manipulate the results.
Also, if we can find flaws in the current system and provide robust alternatives, I'm sure Bitlotto will implement them.
So let's try to find a recipe where the operator could manipulate the results.

If I understood correctly, it currently work like this:
- You buy a ticket by sending 0.25 BTC to a unique and public address.
- Your ticket number is the hash of this very transaction.
- The winning "ticket" is computed through a public algorithm, from public data (hash of a future bloc + real world lottery).
- When the winning ticket is declared, 99% of what has been sent to the public unique address is sent back to the address used to buy the winning "ticket".

Differences with real life lotteries:
- Anybody can see how many tickets have been purchased at any point.
- The ticket number of all the entrants is publicly available (it's the hash of the tx) and timestamped.

Manipulation scenarios
1 - The operator buys 90% of the tickets, hidden behind a flock of anonymous addresses:
- The operator can do that, drawing after drawing, and constantly secure the gains back to himself.
- To do that, he needs to send 9 times more bitcoins to the public address than what has been sent by all other players.
- But any single player can do it as well. If you want to secure the gains, just buy 90% of the tickets yourself. Since the recipient address is public, you know exactly how much tickets you have to buy.
You don't know how many entering tickets are controlled by a single individual, but you do know how many you control. If you want to improve your chances, you can always do it.

For this specific scenario, I think the bitlotto architecture is robust. (Unlike any real life lottery).

Actually you are. Tickets used to be 1 BTC.


Your first post was edited to give the impression that I can't be trusted!


So ALL raffle draws are SCAMS?

THANK YOU! Of course, if there is a flaw I'll fix it. That is kind of cool to think that I could be the first to create a lottery where the owner can play and can't cheat!!

-really the only way to cheat would be to manipulate the outcome of the USA mega millions draw! GOOD LUCK with that!

We can and have done. See bitlotto.com! LOL.

I just re-read the thread.
You've changed the title to "bets entire BTC fortune!" - Holy crap you didn't think I was betting the jackpot did you? That's not my money!!!
My BTC fortune is pretty much a couple BTC!!! I said "own" not "access to"!
 :o

I see now why you were trying so hard!!!

Naw, I'm just havin fun on a day off.  I'm really not worked up. I just enjoy spirited debate, and had some spare time.

Honestly, I'm not trying to pick on you or bitlotto, and I hope this leads to more business for you, assuming you're legit, of course.  You've been a great sport and very respectful.

Like one of the posts a few back, I'm interested in figuring out how the community can have the most ethical, provably honest lottery.  I think you're real close.  I feel like I found a loophole and I think it should be addressed, but it's good to get other people's opinions.  After all, I have nee wrong before!  (Once, when I accidentally bought pencils with erasers).

Forums suck for expressing true emotion, but I am really smiling through this whole thread.  I love it.  Call me weird.......   and no, I have no expectations of getting your bitcoins.  It's just fun to stir the pot a little.

go volunteer or something and where an I'm right T shirt while doing that. Then at least someone will benefit from your time.

Ok. I'm trying to be as honest and transparent as I can. If you can think of tweaks I could do I'd love to hear input. I kind of get what you were saying about me buying tickets but because I only get 1% of the tickets it doesn't work. 40% for sure it could work. The 1% makes it so I can't really buy a ton of tickets at way cheaper cost to win myself, AND it motivates me to create BitLotto into a long term successful business. If you also can think of ways of putting my money in trust to something beyond anyone's control I'd love to hear that too. I know you suggested using clearcoin but the problem still persists. Somebody has to give it the "ok".

Oh and can you please edit your edit of the first post? It kind of makes me sound like I'm cheating!

And good luck if you decide to buy a ticket!! ;D

I wish I could say I was laughing while debating but I'm tired, and was not sober for part of it!  :D BitLotto is my beautiful perfect baby and it got me a *little* worked up. (I'm ok now though!)

jerfelix: i think the thing you are missing is that yes, bitlotto has a small advantage in that their tickets cost .99 on the dollar, but they have the same odds as anyone else. sure they could put 700 of their own bitcoins in and have a large advantage in winning (and then disappear if they lost), but only the light risk and the 1% vig are advantages. You could also put 700 of your own bitcoins in and have the same large odds of winning, but you couldn't run away if you lost.

I agree that the flight risk is the biggest problem, and any lotto should have an escrow that has a lot of other business (so that by stealing short term lotto money they would be forgoing a lot of future profits) but other than that flight risk, its not like bitlotto can recycle the lotto money to increase their own chances of winning.

This is an interest debate. I've read through Bitlotto's website and statements in this topic, and I've found a way he could cheat.

The algorithm he uses to compare the sha-256 hash of the block hash and the mega ball number, against the transaction hash.  I haven't seen any place where he's disclosed this algorithm.

So as of now he could be cheating.  This is easy enough to fix though, by just disclosing the process so anyone can replicate it.

Did you read: http://bitlotto.com/details.html ?
It's all there and always has been. Otherwise I could change how I pick the winner! I did change/tweak the method a few times before BUT EVERY TIME it was done well in advance of the draw and announced so I couldn't cheat.

Sorry about that, don't know how I missed that page.


I'm not sure I'm clear on the formula yet.  What exactly does the secret hash mean?  I don't see a reference to it on the details page.
Did the winning picks come from the secret hash? or did you hash block1 & block2 together?
If the only relevant part of the winning picks are the digits, why does "ec" win? Those aren't digits.


cheers

That was the old method - it was too confusing and still could me manipulated with expensive super computers.

"ec" is just part of the hash. Each payment will have a hash 0-9 and a-f. All mixed up. The draw hash is compared to transaction hashes to find the winner. The hash can not be predicted or controlled since mega millions numbers are added after all the payments are in.

edit- 0-9

Had to look it up to make sure I'm using English right:
digit - The digits of the decimal number system are 0, 1, 2, 3, 4, 5, 6, 7, 8 and 9, and those in the hexadecimal number system are those in the decimal system along with A, B, C, D, E and F.
Letters count. Ultimately I'm looking to find the transaction hash that matches the beginning the best.

Ah alright, just I misinterpreted "digit" as a traditional 0-9 number, not as a hexadecimal digit.
I see you transfer the payment via 1 bitcoin transactions, that's an odd way to do it.

1% is a really small operator's fee, it might be wise to take a bit more to invest in advertising and to put some coins as the jackpot minimum at the start of every round.
both would benefit the players after all

That's the bitcoin software that does that not me. Since I was paid in 1 BTC amounts when I paid the winner it just moved them. When they spend coins though it will probably be combined now.

I don't think I'd change the 1% fee. I know it's very tiny! I know, I barely afford the hosting for the lottery. BUT, hopefully because it's such a good deal for everyone BitLotto will grow based off of customer satisfaction not by advertising. I hope. I think too, as more people win who announce they won, people will slowly trust me more. As the trust grows, hopefully the jackpot will too. I want people who like to play the lottery to have the best experience possible where they KNOW they got their BTC worth and got exactly what they paid for. I want BitLotto to be the place that people go to play the lottery.

Although you're sourcing that from a wiki dictionary and not a word authority like Merriam-Webster, I agree. Just be aware that your usage of digit in your details page is a bit vague if you don't specify the hexadecimal numbering system.



That's odd, I didn't know you couldn't just transfer whatever balance you had.  Well with all the hackings and malware going around if I won I wouldn't publicly announce it.  Looks like you're running the most popular lottery, I don't think anyone is even close to $1,200 USD in payouts.

Thanks. Next time I update the site I'll mention that a-f are digits.



I think you mis understand. The BTC was in the BitLotto wallet. I just send one payment. It did all the moving of coins. It doesn't combine the coins before moving to the next person. It happens all the time when sending BTC. I say to it send 100 it then sends 100 but looking in blockexplorer it sent 1 but 100 times. It's ok, doesn't really change anything.

Announce what?

Yeah, I meant I was just noting that I didn't know you couldn't just transfer in one transaction.

Announce that I won the lottery.

Don't worry: I can't
I don't know who plays or who wins. Only if the person announces they won do I know. So far one person has remained anonymous while the other created a new account to announce their win so I don't really know who they are either. If you win it's up to you.

No, I know you can't. I hope the following clears up what I meant.

:-[ I misread your post and had me thinking I shouldn't announce the win or something...oops. I got ya!  8)

Meni Rosenfeld is correct.  No matter how many tickets the operator buys, the customers don't lose, and the operator doesn't gain.

The scenarios Meni has written are sufficient to show that the operator doesn't gain.  However, to flog this dead horse, here's another pair of scenarios:

Scenario C: One customer buys a single ticket.
The operator collects a 0.01 BTC (1% * 1 BTC) fee.
The customer paid 1 BTC and will automatically win 0.99 BTC, so his expected gain from the bet is -0.01 BTC.

Scenario D: One customer buys a single ticket, and the operator buys 999 tickets for himself.
The operator paid 999 BTC. He has 99.9% chance of winning the entire 1,000 BTC, and a 0.1% chance of getting only a 10 BTC (1% * 1,000 BTC) fee. Expected gain is 999 BTC (99.9% * 1,000 BTC) + 0.01 BTC (0.1% * 10 BTC ) - 999 BTC = 0.01 BTC, same as before.  The customer paid 1 BTC and will on average gain 0.99 BTC (0.1% * 990 BTC) - 1 BTC = -0.01 BTC, same as before.

Regardless of how many lotto tickets the operator buys, his gain is the same, 1% of the customer's bet.  Regardless of how many lotto tickets a customer buys, his loss ratio is the same, the 1% fee which goes to the operator.


The method currently used by bitlotto, as described in the quote below:


can not be gamed by Jerfelix's method, regardless of how many tickets the operator buys.

This is not a matter of opinion, anyone with a correct understanding of statistics can follow the reasoning to its inevitable conclusion.


Therefore, your dilemma is solved.  Bitlotto runs a betting site, he won this very public bet in a forum and you lost.  Since he won, there is nothing to pay up, so there is no reason for distrust.

Now if only he would undo his commentary he added after on the first post.
Many will just read the first post and move on. Dang. Oh well.

tldr; I would like to see a "provably honest" lottery, and provide formal step-by-step proof that a lottery without a trusted escrow is not provably honest.


First, realize that this whole thread started with a comment by Joan that said "Lotteries need to be provably honest."  Keep in mind, I didn't start this thread, despite the appearance to the contrary.  I made a comment in response to Joan in another thread, and apparently an administrator thought it was interesting enough (or off-topic enough) to merit its own thread, and moved in into it's own thread, making my message the lead comment.  The original topic was "Re: Bitcoin7 a new exchange" as you can see in some of the early messages starting with message #2.  In an effort to have it make sense on the forum (since the admin forced me into a position of "thread first post" with a message that didn't make much sense as the first post, and made it look like I made no sense), I changed the topic and the intro to the first message, because having it called "Bitcoin7" wasn't logical.  If that appears "dishonest", tell me what you want it to say.  I have already edited it twice in an effort to have it make sense to the casual reader, and in an effort to appease the user Bitlotto's claims that I was being dishonest. I can't guess at what you want.  I have never accused Bitlotto of being dishonest (even though he accused me of that), in neither the current thread, nor the pre-edited post.

Second, I have no malice toward bitlotto (the user or the service).  My goal in this thread is simple:  figure out a way to create "provably honest" lotteries, and determine whether there is one already.  The Bitlotto service may be completely honest (and I've stated already that I believe that it likely is), but the challenge of this thread is whether it is provably honest, as stated in the very first message.  It got more interesting when Bitlotto, the user, made a claim that his service is "cheat-proof".  Remember, the goal is to have "provably honest" lotteries, and so if this claim is true, he may have one.  But I don't think so.

I believe Bitlotto wants his service to be provably honest, and I made a suggestion as to why I don't think it's cheat-proof, and how it could be improved with a trusted escrow.

Step By Step Proof

So, as a proof that Bitlotto, the service, is not "cheat-proof" without a trusted escrow, here's excruciating step-by-step proof (sorry so long).  If you disagree, please tell me which particular step in my logic is flawed.

Step 1.  In order for a lottery to be provably honest, the participant's true expected payout must be equal to the published expected payout, which is published by the lottery operator.

Step 2.  It is impossible to tell whether a lottery participant is affiliated with the lottery (either the lottery operator or a shill).  I believe this is self-evident, and user Bitlotto also made the claim that the participants are anonymous.  Even if all participants stepped forward and individually identified themselves, it's impossible to prove that they are not affiliated with the lottery operator.  (It's often impossible to "prove a negative".)

Step 3.  The operator can purchase tickets to his own lottery without being detected.  (Thanks to Step 2)

Step 4.  There is a concept of "finite".  Users have finite lifespans.  Operators have finite lifespans.  Companies have finite lifespans.

Step 5.  There is a concept of "virtual certainty".  (Any supporter of Bitcoin should understand this concept, as the whole Bitcoin system is based on virtual certainty principles, from the confirmation process, to the effort to create unique Bitcoin Addresses.)  There are events whose probability is so high that it is "virtually certain" that they will happen.  And within the context of a finite number of trials, they will almost certainly happen every time.

Step 6.  It is possible for an operator to purchase tickets to their own lottery with virtual certainty of a win.  This step is perhaps best demonstrated with an example.  Using extremes, it's easy to see that this is true.  Let's say Satoshi holds 600,000 Bitcoins, and he holds a random monthly lottery whereby he convinces a single user to wager .01 Bitcoin, with the potential payoff of 600,000 Bitcoins.  Satoshi holds 60 Million times as many entries as the user.  While all lotteries are long shots, you can predict with virtual certainty who will win this lottery every month during Satoshi's finite lifetime: Satoshi.  Note, it's important also to note that a VERY small change from approximately 1 in 60 Million to 0 in 60 Million is the difference between honest and dishonest; Satoshi purchasing that many tickets in his own lottery does not in itself make the lottery dishonest.

Step 7.  It is possible to "launder" Bitcoins such that you can hide your identity and pay yourself, without everyone being able to detect who had the original Bitcoins.  (No need to read this whole step, unless you don't believe that it's possible to launder Bitcoins without "everyone noticing".)  Once again, easy to demonstrate with an extreme example:  Let's say you have 1 Bitcoin that you are trying to launder.  You can transmit 1000 Bitcoins to an account, with that 1 Bitcoin bundled as part of the transaction.  And then transmit 1000 Bitcoins to 1000 separate accounts, and the particular "1" Bitcoin is effectively lost.  No one can say with certainty which of the 1000 accounts holds the "dirty" one (in fact, every accusation is likely to be a false accusation as, in this example, 999 out of 1000 accounts are clean.  If you don't think that's enough laundering, run it through the same process 1000 times).  There are a number of well-documented ways to move money around to launder it.  You may even be able to set up an anonymous Mt. Gox account using Tor, transfer the 1 Bitcoin to the account, wait a week, and then make a 1 Bitcoin withdrawal.  During that week, "your" 1 Bitcoin will likely have been bundled with others and sold, and the one that you withdraw would be clean.  Not everyone would notice that you did that.  In fact, everyone would NOT know - only someone with access to the Mt. Gox logs would be able to tell what the "new coin" was, and if he were a co-conspirator, then it'd be possible that no one else would know.  Laundering money is possible with Bitcoin (even though laundering large amounts is difficult, it is still quite possible to launder money so that not "everyone notices" that the lottery operator is paying himself).

Step 8.  A lottery operator can shut down his lottery and take all the bets without paying off a winner, effectively stealing money from lottery participants.

Step 9.  A lottery operator can launder stolen money. (see step 7)

Step 10.  If a lottery operator's mode of operation is that under certain circumstances (of even miniscule probability), he will steal money from the lottery participants, and this plan to steal is not published in the lottery rules, then the user's true expected payout is less than the published expected payout, and therefore, by definition in step 1, the lottery is not "provably honest".  (Note, this is regardless of whether the circumstances which trigger the planned theft ever occur in finite time.)

Step 11.  It is possible for a lottery operator to, unbeknownst to the participants, purchase tickets to his own lottery, to create virtual certainty that he will win (Step 6), and have an unpublished fallback plan (which is virtually certain to never have to be executed), to shut down and steal the jackpot, and launder the money (Step 10). 

Step 12.  Lotteries that do not employ trusted escrow services cannot be "provably honest", because such lotteries can have a mode of operation whereby they steal from the participants under certain circumstances (as mentioned in Steps 10 and 11).

Q.E.D.


"Virtual Certainty" means with an extremely high probability, and you can take all of the above steps and apply them with lower probabilities within the context of finite lifespans.  You may be questioning the relevance of this proof (with extreme examples) in the context of one like Bitlotto.

The simple, very practical example that I already gave is that an unscrupulous lottery operator can set up a lottery whereby he runs a monthly lottery selling 1 Bitcoin worth of legitimate tickets and buys 130 himself, with the plan to run off with the money if he fails to win.  He will make approximately 10% annual return on his "investment", and his lottery will have an expected lifespan of ten years before he runs out of luck.  Further, if he pumps his gains back into his lottery, he can extend the expected lifespan of his ruse.  And if his monthly execution is that he buys all of his tickets on the last day, then he ties up his money for very little time (12 days a year), while making 10% annual return on his money.  Over ten years, he never makes a legitimate payout, and every monthly "drawing" is a scam, despite appearances to the contrary.  Low risk, minimal investment, reasonable payback.  You can alter the parameters to achieve the risk/reward that you find desirable, but I contend that an investment returning 10% per year with very little risk and the opportunity to make the risk even less in greater years is an attractive investment. 

I also asked the simple question as to how we could prove that Bitlotto DIDN'T do that already, to which all I got back was that the burden of proof is on me, to prove that he did.  No, that's not my obligation.  I'm not set out to prove that BitLotto is a scam, I'm trying to prove, and feel I have successfully proven, that it's not "provably honest".  And so it's not my obligation to prove that he did cheat; It's my obligation to prove that he could have cheated (which I feel I did in earlier posts, and just did again in this post), and thus far no one has been able to find legitimate fault with my proof.

Changing the subject away from a particular lottery and speaking generally: to me, it's obvious that a lottery that plans to steal the money under certain random events, without disclosing this plan in the lottery rules, is dishonest, regardless of whether that random event ever occurs.  If the Satoshi lottery mentioned above in Step 6 had the published plan of "your odds of a payout are 1 in 60 Million", but with a real plan of "if that 1 in 60 Million chance hits, I'm not going to pay off anyway", then it would be dishonest, regardless of whether the one-in-sixty-million long-shot event ever occurred.  And that long-shot event will likely never occur within the span of Satoshi's lifetime, yet such a lottery is dishonest.

All of this proves that any claim of "It's cheat proof" is false.  And that it is possible for a lottery operator to "pay [him]self without everyone noticing".  These were the exact challenges that were put forth in thread message #4. 

Unless a Lottery operator can prove that the published expected payout is accurate (and that he has no plans to run off with the money), he cannot have a provably honest lottery.  By instituting a trusted escrow, it's possible to reduce the likelihood of an operator being able to execute a plan to run off with the money.

Why am I trying so hard?  Because I want a provably honest lottery.  And to me it seems pretty clear that this is not provably honest (and that it's a hard problem to solve) and I can't believe that I'm having a hard time convincing certain other people to understand what I think is obvious.  And if I am wrong, I want to know exactly where I am wrong, because I am not seeing it, after reading numerous futile messages to enlighten me.


P.S. I'm not sure what the reluctance is to running a lottery through a trusted escrow.  Is it the cost?


:: dead horse, beaten beyond recognition.

;D

Well, the "build trust and then run away at some point" can be applied too.
I agree, the operator cannot prove that he won't run with the money. In this sense it's not provably honest. Neither is a third party escrow unfortunately.

The point of dissension I think is step 11.
The premise to this is that no player will prevent him.
As a player, I can make sure the operator does not execute step 11, because I can myself purchase enough tickets to remove this virtual certainty.
(Indeed, I can purchase enough tickets to secure the virtual certainty in my favor).

Admittedly, this may end in an arms race to secure the odds, (and we're back at step 4: users have a finite amount of bitcoins to play with).
It's not a proof of honesty per se obviously. But it states the existence of a method for any player to be sure that he is not tricked with the technique you detailed.

Step 6 is broken easily by the NOT indefinite amount of Bitcoins in the system.
The maximum amount of Bitcoins the lottery could hold are "total current Bitcoins - my Bitcoins", assuming that the lottery also runs the entire bitcoin system.

The worst chances of winning therefore are "My bitcoins/total bitcoins".

As soon as "My bitcoins" grows large enough, the lottery cannot any longer outbid me 1000-fold (or whatever is considered "virtually certain"). Assuming Satshi has 10% of all Bitcoins in posession and breach of trust (just taking the money and running away) is not cheating, but a different "attack", the maximum amount the lottery could bid against him would be 90% of all Bitcoins.

Long story short:
It is not possible for the lottery owner for arbitrary amounts to gain "virtual certainty" of winning. This means, he must impose maximum amounts that players are allowed to play each round to make sure he is always _able_ to overbid. Also just 1:100 or 1:1000 might not be enough, depending on the intended lifespan of such an endeavour, plus it would give less interest the better chances you want to have (if you overbid by 1000 each time, you just have 0.1% interest each round)

Me buying tickets is only a problem *if* I'm planing on running one day. I get that. You pretty much say that all this *cheating* depends on me planning on running. I get that. BUT it would be noticed when I do!

*I'd love to do escrow* I really would. I just don't know how I'd set it up!!
How?

Someone somewhere has to hit PAY! That person could be a player themselves. That person could be someone who just lost a lot of money. Who would we pick? I think someone said Gavin? Well, perhaps he's not interested. I wouldn't want it to be an American (No offense) It's just that the laws are a big jumble of white,grey,and black. Almost everyone is a criminal in some way. We could think it's safe having someone hold it only to have another big lottery company complain because they don't want to compete, create a panic in the media, and money seized? Now it's lost.
Is money held in escrow in the USA more risky? What country then? Perhaps it's safer having an anonymous person having it? I only have access to a small amount right now. I'm still building trust. You say I could be waiting for a big jackpot to run away with. I think that would be STUPID of me because:
-I'd for sure have committed a crime - theft
-I'd piss off thousands of thousands of highly technical people -I'd be caught eventually -Having Anonymous after me for example would make my life a living hell
-I'd be miserable always wondering if I'd get caught
-The 1% is the key: I can make a comparatively small profit honestly, no worries, and with time I can make money off that 1%, I don't NEED to steal it (I'm even going to teach my partner how to pay the winner if I die!)
-It is in my best interest to operate a legitimate lottery

UNTIL I run with the money, all the draws can be demonstrated to be sound. Sure my *intent* could be in doubt BUT each draw can be proven that the rightful person got the winnings.

IF someone can show how I can do escrow safely that doesn't have the risk I mentioned I'll do it. I really will.

this is cool

After reading and enjoying this thread, I'm off to bitlotto.com to buy some lotto tickets. 8)

LOL. Thanks, that kind of cheered me up! Good luck!!! I just wish is was easier to explain BitLotto's unique features.  ;)

I think you are delusional about most people agreeing that he lost.  I know I for one don't agree with that. 

I also think your reputation has become  more at at stake here then his.

How can everyone here continue to side with BitLotto? It's been clearly proven that there is a flaw without an escrow service.

Cause I'm nice?  ;) Yes, I agree escrow is a small flaw. That doesn't make it so I can manipulate who wins though. I also explain that escrow just moves the trust and adds another person that needs to be trusted. No matter what, someone has to be trusted. With time I hope to prove that it can be me. Whoever has access to the money can be a flight risk. I hope that earlier in this thread I explained well why I would be crazy to do that and because of that I intend on operating an honest lottery as long as people play. 

Any escrow service could also do exactly the same "trick" (running with the money) and even additionally has to trust the operator of bitlotto that he provides correct data in the first place.

Even if someone (like the operator) writes an Open Source program and publishes that, he chould still run a modified version in secret, and I'm not sure how feasible/possible it is to proove via a remte connection that you are ONLY running a certain piece of code. In the end you have to trust someone, if you hand over money and the approach of extending that trust over not too many people is a good one in my opinion. If you don't agree, you can do something else as well than play a lottery! ;)

Because it has not been clearly proven at all, and saying it has been while good nlp does not make it so.

Clearly proven that it's a flaw, yes, that it will be a problem no. In terms of the chain of trust it is most definitely a gap, obviously an escrow service or anyone lese is only as good as the reputation they have, an established escrow service should have more trust because it's what they do.