While on the topic of provably fair, one idea I had would be that users could pick a client seed string like "LuckSeed" that they use on the app page. Then each bet the app does something like:

sha256('LuckySeed|' + nonce)

and take the first 4 bytes of that hash to use as the API client seed on MoneyPot. That has the huge advantage of:

a) The app being able to instantly verify each bet  (which is, way, way easier to do programmatically)
b) The user is able to batch verify bets  (which is way, way, easier to do as a human)


The big disadvantage is that if the app developer was conspiring with moneypot they could send the "client seed string" to moneypot which would allow moneypot to predict what clientSeeds the bets are going to use. In reality it probably wouldn't be feasible, but is a bit inelegant.  I guess it's up to each individual app to decide if that's a good idea or not. But for the case of a downloadable betting app (which requires trust) it seems perfect.


But for a website probably the best thing to do is:


a) Generate a strong, unpredictable client seeds for each bet (I recommend something along the lines of dustdice's function: https://gist.github.com/RHavar/a6511dea4d4c41aeb1eb )


b) Store/Save the server hash in the case of errors, or before making bets. Using localStorage is fine. The idea is that if moneypot ever returns an error, the same hash and client seed must be reused  ( to prevent the described "stalling" )


c) Actually verify that the results are what they should be, the hash matches and the profit is expected. In the case of any provably fair error, the app should at least notify the user

Sorry about that! Our bitcoin-core node keeps getting crashing. I'm having trouble figuring out why, disk usage is only 40% and it never uses more than half the memory. It's the latest version (0.11.0) too, and the logs don't contain anything interesting

I'll setup a cron job to reset it if it's down, and try figure out the root cause

Extortion demands are pretty irrelevant, I was in communication with one such person before and I asked him if he really expects anyone to pay and his response was along the lines of: "lol no, but it's fun to make people stress over it"

Short of a public confession, the source of DDoS's are pretty much unknowable. However, I've had nothing but positive interactions with other site operators, so I don't subscribe too much to the hostile-competitor theories. Most of us are in the same boat trying to make bitcoin gambling strictly superior to fiat gambling.

Regardless of the origin, the course of action is always the same: hardening the systems against further attacks. So let's just assume the best, and not sow too many seeds of distrust =)

Well, we've always been risking way too much. Right now, it's basically a 10x kelly. The reason we've been doing that is for strategic reasons to attract more players (winning 9 BTC is a lot more fun than winning .9) , but as our bankroll increases we afford to be less and less reckless and approach a more optimal 1x kelly.



New feature: language chat filters! Join one of the 40 languages!

Assuming we trust the provider, how can we verify that the value they use is really from the provider?

Absolutely, especially for a new casino.


I don't see that as a problem. As long as they never let anyone attempt to win more than what they have, or what they are willing to pay ... it's fine. Probably 99% of bitcoin gamblers are ok playing at a casino that would stop the action when players won a total of 50.

Bustabit for instance started from a very modest bankroll, and grew from there. While there were certainly people who were put off by the low limits, it didn't stop it from being a success (or instantly paying out the winner who took half the bankroll)

BTW your provably fair system doesn't really work. You use:


but with a global secret key, every person with the same seed will have the same result. It looks like you default everyone to the client seed of 'BITCOIN' and as you'll notice, everyone gets the exact same outcomes.

The two ways to fix this, would be to enforce that no two users can use the same client seed (kind of annoying). Or use:



Also, I'd recommend using a scheme that allows people to verify instantly. No one likes waiting a full day to check the results. I'd shameless rip the JD scheme, it's well understood and has many independent implementations.

That probably would've been me. I sent 0.125 via d01ba3080ea7a08b8bcc846c739089f45838f95bd7c059315214a10235cca098 but ended up getting distracted by issues on MP and never ended up trying it.

You can send a refund to 1LxvTVUQd5ArkutedzZgWWYcqGFKNVZ8ke if the site's going to be down


Refund Received! Thanks guys.

MoneyPot should be back at full capacity. Hopefully it lasts!


Agree. We actually do have a notification system, but during the latest attack on the webserver almost every request was timing out so it wasn't particularly useful. Maybe a twitter or status.moneypot.com would be more suitable

Yeah, looks like it. Went to sleep thinking I fixed it, but they just switched the vector a little. Give it another try, and with any luck you'll be able to get in  (and if you do, the hot wallet has lots of funds).

Hopefully within the next 30m I'll have the situation under control again, and go back to sleep


Edit: We're back at full capacity once again. Time for more sleep =)

Yeah, sorry. The issues are on MoneyPot's side. The fix we put in place did it's job, but they've switched the vector a little. Working on another fix, shouldn't be much longer I hope.

Moneypot is designed to be an open system, that allows anyone, without permission or review to create their own apps. It's not unlike how anyone is free to use bitcoin without permission or endorsement from satoshi =)

And just like bitcoin, it's up to app developers to make their app interesting enough, or promote it well enough to be a success.

Yeah, was too busy fighting some fires to notice the depositor got hit too Thanks for the heads up

It's restarted with a different ip address, and all deposits should be credited

MoneyPot is currently getting hit by a reasonable amount of load and not handling it particularly gracefully. I'm actively working on, but please excuse any timeouts or general slowness.


Edit: Now offline. Working on it. Should be back online in a few minutes
Edit 2: ..and back online with some mitigation. Hopefully that is the end of it =)

Hm, that looks a like a moneypot error. Could you try again? We're having a little issue with a bit of a DoS at the moment which I'm addressing

Sorry about that! That brief downtime was a moneypot.com issue caused by what appears to have been an accidental DoS by one our API users. I'm putting a fix in right now to prevent (that particular) thing from happening again =)

Happy 1st Birthday Bustabit!

Unfortunately, I wasn't feeling great and wasn't around to celebrate it properly. But I'll try organize something special for when we hit 200k wagered.


Also as few people have asked me for it, so tomorrow I'll probably also raise the max bet to 2 BTC. That will also coincide with changing the max-profit to something a little more sane, like 1.5% of the bankroll (instead of the current 3%)

This probably means it's unable to connect to the gameserver for some reason. Could you try open the browser console and see if there's any errors? I've heard some people saying the connection is blocked at various places

Agree. Yeah, this is something I really need to address. If I were to die tomorrow, a lot of bitcoins would end up lost. Part of the reason I built the proof of liabilities, was that if something happened to me it would give people a way to prove how much money the site owes them and from this it would be possible to pay them out. I just need to put the whole thing into action, and convert my cold storage into something like 2-out-of-3 signatures.

I guess an inherent problem with a site that hold too much users money is the financial incentives start aligning going rogue.

For instance if you compare my two sites: bustabit and moneypot. Bustabit is completely self bankrolled and typically holds ~20-30 BTC in players funds, but makes 30-50 btc a month. Stealing players money, or doing anything to jeopardize it's legitimacy would be totally retarded.

Now take moneypot, at the moment it's probably only makes me a bitcoin a month or so, but holds >125 BTC of other peoples money. If I was less scrupulous, it offers the ability to undetectably steal from investors and if I doubted it's long term prospects going dark might be attractive.

Fortunately however, I'm not a psychopath and optimize for a lot more than financial incentives. But that's something that I can't ever prove and even if assuming it's true there's other ways you can lose your money with me (gross incompetence, me getting hit by a bus, someone putting a gun to my head). All cases I want to improve protection for players though =)

Anyway, I don't mean to alarm anyone or anything. I just cringe a little every time someone downplays the risks.

And of course, I think moneypot has ridiculous potential and I'm extremely invested in it's success =)