Well the nice thing about doing this on bustabit (or indeed any repudiable provably fair site) is that you can quantify your risk/return, unlike HYIP/Ponzis which just take your money when ever the operator feels like it

They would only lose the block, if it was profitable to do so. If they win the bet,  they would face only a tiny extra cost of losing a block (likely slightly slower block propagation, due to mining a few extra transactions that the network wouldn't have seen)

And keep in mind that for a shady pool to withhold a valid block might not actually cost them very much at all. This is because they can cheat their miners, and just act like it was bad luck that caused them to have not mined a block in a while.

---

(Although in practice it's not really a concern. For someone to exploit them, they would likely have to risk 15 bitcoin (With the hope of winning 1). I doubt anyone is ever going to do that, as the chance of them not getting paid would be too high)

Just for everyone too lazy to do the maths, if you are betting > 0.04 BTC per bet, this site offers better odds. If you're betting less than that, you're better off playing a traditional 1% casino.


Although personally I'd be too skeptical to play here. The site is trivial for a miner to profitably (and undetectably) cheat...   (and even more so for a mining pool, which can cheat it's miners at the same time if they have to discard a block)

Yeah, actually my main reservation is just people using them to troll other users ("hey, you can login to my account if you want 1 bitcoin. The password is $POISONPASSWORD). I'm not quite sure how to handle that case

https://anduck.net/bitcoin/fees/

You'll see routinely 1-3 times per week, transactions with a feerate of 5 byte/sat can clear.




This doesn't make much sense. Why you even running the site if you're taking a flat loss per bet? And all you need to do is write some utxo consolidation logic, and you'd be making a decent profit per bet.

No, the poison password would be for when you know 100% someone it is trying to phish your password. e.g. if someone links you to the scam site bustabit.tk it might be obvious to you that they're trying to steal your password. So instead of just closing the tab, you'd give them a poison password. Then when they go to use the poison password to try in, bustabit would know that they are scammers, and silently lock their ip from future attempts.

No, but they wouldn't need to. The point is to poison the results of someone phishing. Imagine you made a phishing site, and 80% of submissions were poison passwords, and 20% were real. It'd be really hard to figure out which were real and fake, as by attempting the poison password the site would know you're a phisher (and any real logins you do would end up getting locked)

I don't really like these sort of security policies, as it's not overly hard to proxy that "word or phrase" .. and especially in "spear phishing" attacks, where you're targeting a specific user, it's easy to lookup their "word or phrase" and then show it to the user on the phishing site (which then gives users a false sense of security).



I was actually thinking about having something like "poison passwords", which are fake passwords that you can generate, that you can give to phishing sites. If someone tries to login with a "poison password" they get banned from trying to login to the site, and any successful login they do locks the account. This way you can disrupt anyone phishing by feeding them a bunch of poisoned password.

I'm not sure that the advertising is terribly honest.

The processing fee you charge is rather high, based on running a casino it costs me a little under 500 satoshis per deposit to process (as I consolidate outputs when it's cheap), while your processing fee is 40000 satoshis. Which would be an entirely entirely reasonable processing fee for a winning bet, as sending a transaction fast is quite expensive. However, the tricksy part is that you take the processing fee before you apply the multiplier, which means the player is effectively paying that 15 times!

So based on the costs I believe the break even point would be charging ~2421 satoshis per bet in processing fees  (assuming efficient utxo consolidation). Which means you have an expected profit of around $0.46 USD per bet.



So while I understand it's a business, and your goal is to make money -- I think by claiming to be 0% house edge and not making it clear you make a flat profit on each bet is bit ifffy.

It's not fair to blame players. In this specific case, the max-bet rule is located in the wrong section titled "free spins" which not only makes it hard to find but also unclear if it only applies to free spins or not.


And secondly, and most importantly -- it's completely reasonable that a person would expect limits are enforced. My casino has a max bet rule (currently 1 BTC), and if someone tries to bet more than that (which happens often...) the server returns an error and says it can't accept such a bet. But to accept the bet, and then confiscate the users funds (often unrelated) for terms of service violation is total and utter bullshit.   Doing so takes money for an innocent mistake or misunderstanding. It's one sided, it's predatory and it's outright scammy.


Just to be clear, my issue isn't with max bet rules (that's fine). It's not enforcing them on the server, then confiscating money from players that I take issue with. I haven't heard any complaints about FJ in particular, but I'm happy to call them out if they're also scamming users.

An example of a really poorly done phishing site that will steal your password and money bustabit.tk/

(there are some more convincing ones, but I won't link to them)

Just a heads up, there's at least 3 bustabit phishing sites actively being given out to players.  Please be very careful, if it's not https://www.bustabit.com/ do not ever enter your password. Phishing sites will look identical to bustabit, so you need to check the URL. Also don't be tricked by silly claims like it's a secret site that lets you login to the admin panel, or anything like that. All these sites are use purely for stealing your password and then your money.

Also, I almost never send emails (I don't think in BaB history, I've ever sent a single mass email) but if I do it will not contain links. So also be suspicious of any emails you get, they're pretty likely to be fake.

Yeah, I believe they now enforcing the limit so that people didn't unwittingly violate it and have all their money taken (although AFAIK they never returned the money they unfairly took)

While winning a car is definitely cool, I think most people would prefer the money in cash/bitcoin. That way they don't need to de-anonymize themselves, and if they really want a Lexus GX 460 they can buy it with the money.  And not to mention, you might love that car but not everyone is in the same situation. Like personally I have about 0 use for such a vehicle, and no where to keep it. The first thing I'd do if I won it was try sell it.


I've tried running a few giveaways before (for smaller value stuff, like Trezor's) and I'd say 90% of the time people have opted for the cash-equivalent.


That said, there might be some marketing appeal to it if you offer the cash-equivalent. People probably have a stronger emotional reaction to seeing a "Lexus GX 460" compared to 44.6 BTC.  And if you offer the cash-equiv people can just pick that, so you end up with the best of both 

This doesn't seem fair at all.  It's not listed on their ToS, but on a separate page (bonuses terms) and under the (wrong) section called "free spins".

If you accept a bet, you should honor it. I think it is completely and utterly unethical to accept a bet which would result in someone losing all their money for a ToS violation. If you can't write an if statement to enforce your own limits, then frankly you should not be running a casino. Or at the very least, do the fair thing and run a cron job that reverts all bets (wins or loses) that were above the max bet limit (so it doesn't benefit or harm players). Just voiding someone's entire account is totally unreasonable.


Unless mBit Casino disputes these facts, or can explain how having people accidentally violate the ToS so you can take their money isn't insanely predatory, I intend to leave negative trust as I did on bitstarz for the same nonsense.

Yeah, a leaf out of bitstarz book. It's pretty bullshit. It's not listed on their ToS, but on a separate page (bonuses terms) and under  the (wrong) section called "free spins".

If they can't use software to reject the bet (it's literally an if statement..) and they use it to void winnings, it's insanely predatory.

More generally, it's an effective way of stoping high-variance playing styles. Let's say they give you a 1 BTC bonus, they'll typically design the play-through requirement such that you won't be able to withdraw you unless you have expected loss of >1 BTC (often as high as 5 or so). However, because of variance peoples actual loses aren't equal to their expected loss, and it's possibly if they're lucky they'll make a nice profit. That wouldn't be good for the casino, so what to minimize the variance they want to forcing you to play a very large amount of very small bets. This makes it exceedingly rare to make more than your expected loss.


Which is pretty much why I in general advise people to avoid accepting bonuses (and often the sort of places that like to mislead their customers into taking them). Instead of having fun with your money, you're often dragged into effectively turning over fake money until you end up losing it.

Sure, but the problem is they can't be sure that the old owners don't retain a copy (e.g. have the backup seed somewhere etc.) [1]. If something did happen to their cold storage, they'd really have no way of knowing if they got screwed by the old owners (or some malicious software) or something. And like wise, the old owner knows if there's a problem they will always be suspected.

If I was either the seller or the buyer in this situation, I can't imagine ever agreeing to such terms.


[1] It's possible some hardware wallets with software attestation like ledger could provide the ability to check if the private key has ever been exported or not. But that's not really realistic, as I don't believe they have this feature and it's not like satoshidice would've been running a cold wallet without a backup.

If it's software enforced (e.g. you get an error if trying) it's not so bad. What was *a lot* worse was when dodgy sites like bitstarz would review the play history of large winners, and if they violated that rule (even trivially) they would confiscate the entire account balance for "terms of service" violation.

So at least if it's software enforced, you don't run the risk of losing your entire account balance due to a mistake (or not reading the fine print).


That said, I think people should avoid using bonuses in general. In almost all cases they're carefully designed to benefit the casino, while giving the player the impression it's good.

That seems like a worst of all worlds approach. If something happens to the cold storage, it won't be possible to know who was at fault. I can't imagine why either the new or old owners would agree to that.