Not just hoping, we are sure that EOS will be the truly scalable blockchain platform due to its interblockchain communication feature.
If in future, there are more players on TrueDeck platform that EOS can support, TrueDeck community can decide if they want to launch
a separate TrueDeck blockchain to support millions of players.

It is not a promotion, it’s just an information regarding casinos in crypto. We are only responsible what we are saying not what you are understanding, if you feel like this was an promotion, just let the thread owner say so, we don’t have any problems in removing that post. By the way this thread was posted on March 22 and still didn’t reached 2 or 3 pages , so don’t know what you mean by promotion, anyway common sense is not so common, we can remove that post.

We at TrueDeck, are creating a Blockchain based Casino Platform which is open, decentralized and trustfree.

We're not a casino but a technology to create new casinos and join them with other casinos in a single network.

TrueDeck is working at decentralized technologies mainly Decentralized Random Number Generation (DRNG) and Mental Poker Protocol.

Both technologies will enable players to play casino/gambling games without the involvement of a third party.

We're partnering with existing blockchain casinos to expand our network of casinos.
In future, when TrueDeck platform is live, TrueDeck technology affiliated casinos will be able to provide transparency to their players.

Apart from that, All casinos will share the same bankroll, which will lead to large prizes to each casino player in the network.

Development is already going on and now we're soon launching our promotion campaign.

You know how x2 is either roll under 49.5 or over 50.5 for 1% house edge dice site? x99 payout is roll under 1 or roll over 99? The losing rolls are always in the middle of the 0-100 rolling range.

So since a new server seed is provided for each new bet, they could select their server seed assuming the client seed doesn't change and give numbers that tend toward the center of the range instead of being random. Here's what would happen.

1. Client changes the seed after each new server seed, before every bet. He doesn't know server seed, so seed he provides should give a random number. (Painfully tedious, few actually do it, but for those who do, provably fair.)
2. Client doesn't change his seed. All bets are rigged and he doesn't play with a 1% house edge. This would be impossible to be caught since the roll would still match the seeds.

- No, you wouldn't be able to cheat the casino, because the number would still be randomly over/under 50. It would just be closer to 50 than average. The number doesn't need to be on the opposite side such that you could counter it by switching over/under to abuse it. It just needs to be closer to 50 than random numbers would, creating more losses for players. No counter.
- No, you wouldn't be able to notice that the website, across all players, has a much higher house edge than 1% which is unlikely. It's easy to fill with fake "lucky" account to compensate for the actual players who are "unlucky" and have a credible total wager volume/profit. It's also easy to limit to large account/smart targeting.
- No, you wouldn't be able to notice that no actual players report winning, because even if they gave themselves a 2% or 3% house edge or targeted accounts doing large bets for a very large house edge, there would still be winners.

This is the story of how we lost around $1 million worth of bitcoin to a hacker who exploited our online casino’s RNG system. This happened last year, but we’ve decided to share our experience for transparency and so that others can learn from our mistakes.

August 2014

Shortly after the launch of the third version of Primedice, our team faced an adversary that challenged the existence of our website. Our team had nearly two years of experience building bitcoin gaming sites, however I personally had pretty limited coding experience. We were under heavy pressure to avoid further delays and released after a short week of closed beta testing.

The heist began immediately after launch with two unusual players, Nappa & Kane. We noticed unusual betting patterns from both those accounts. Kane was automatically cashed out, we reviewed Nappa’s bets and thought they were highly unusual but could find no wrong-doing and cashed him out after a delay and a brief email exchange

September 2014

After getting spooked by his delayed cashout on Nappa, the exploiter waited a few weeks and created a new account named “Hufflepuff”. Hufflepuff was the largest bettor Primedice had ever seen, he was often seen betting upwards of $8000 worth of bitcoin every second for hours on end. Our entire team was shocked that Hufflepuff continued to beat the house edge (1%) and stack up more and more profit over time.

We were highly skeptical of his winnings and were forced to hold his cashouts time and time again to investigate and each time our developers could not find any wrong-doing. We couldn’t justify greatly delaying his withdrawals when there was no evidence he was cheating. There was also strong incentive for us to promptly pay him, so he’d keep playing. We heavily explored what we thought was every possibility, ran simulations and did the math and came to the conclusion that he was just incredibly lucky.

The Discovery

About two days after sending his final withdrawal placing him above 2037 profit on the Hufflepuff account alone, our main developer detected the exploit after we found a handful of accounts sharing the same server seed.

To understand how Hufflepuff beat our system, one must understand how our provably fair system (RNG) works. A user is shown an encrypted random value (the server seed) before they bet and they must also submit their own random value (the client seed). These two random values are combined and used to determine win or lose. The random encrypted random value used for the bet then is shown to the user after the bet so that they can be guaranteed that their bet is not rigged. You can find the detailed and in-depth explanations of provably fair here:

https://primedice.com/verify and http://dicesites.com/provably-fair

Part of the functionality of our site is that we have to give out decrypted server seeds (to assure users no bet manipulation has occurred) and put a new random seed in place, essentially trashing the old revealed seed. Hufflepuff found a way to “confuse” our server, and made it give out a decrypted server seed that was also an active seed. This was done by sending it more requests than it could handle in a small time period, think hundreds of requests in under a second. The result of this is that he knew all the information required to corroborate the outcomes of his bets. He knew whether if he would win or lose, and could wager accordingly.

We figured this out after frantically checking our servers after a eureka moment. We suspected something could have been going on and eventually realized the possibility of a timing attack described above. Our database had seeds that were both inactive and in use at the same time all connected to Hufflepuff. Along these “Schrödinger” seeds existed many seemingly unused seeds connected to the same accounts, indicative of the rapid fire of requests needed to obtain these.

Déjà vu

Unfortunately we detected this exploit after cashing out Hufflepuff and his handful of accounts 2400+ coins (roughly $1M at the time). Given the nature of Bitcoin there wasn’t much we could do but take it on the chin. We reached out to Hufflepuff via his bitcointalk forum account and demanded the return of the coins, however this backfired unbelievably hard. It turned out that our developer had improperly patched the glitch. In response to our message, Hufflepuff created a new account named Robbinhood and proceeded to rapidly win 2000+ additional bitcoins using a work-around to the patch. He was unable to cashout more than 50 or 60 coins this time around as our site hot-wallet was drained.

Shortly after he privately sent us this message which was preceded with the dox of a primedice employee:

    “Your offer is declined. Your demands are laughable. I’m happy to walk away and leave you be, but if you’re going to take this further, then so will I. I don’t think you want this to go further. I actually enjoy this shit. Your move.
    Oh, and by the way, there are some pending withdrawals that you need to process.”

And that was the day the house didn’t win…
Evidence for transparency and investigative purposes

Hufflepuff’s deposit address: https://blockchain.info/address/1BiPXmDrHm7VXZnWy6NnW1ZbPc4dcpfkH5

His primary withdrawal address: https://blockchain.info/address/14iS2UvcLK33xkC1K1qL1dhEbp49aiNfNp

Email: hufflepuff@anonymousspeech.com

RobbinHood withdrawals:

https://blockchain.info/address/14HQ67ZhmATviHi9RdYhbUriAGSFmJpYoB

— Note — : Nappa/Kane were two other usernames used early on, amongst many others.

Kane’s Withdrawal address: https://blockchain.info/address/18dMBap634aESPTeD3FGcAgJ2S9n4qtBTZ

Nappa Deposit address: https://blockchain.info/address/16h9ggSzUWdvagEJdNvWVYiUkytw6SJgiB

Nappa email: kritonian@outlook.com

Some IP’s used between accounts: 184.75.221.106, 184.75.223.34 , 151.224.50.156 , 76.179.22.16

Any information that leads to the return of the coins from this incident will be greatly rewarded. We invite you to analyze the above bitcoin addresses and find out where the bulk of the coins ended up if you have the skills.

It’s also important to note that this incident is proof of the strength of our integrity and provably fair system. If at any point we attempted to rig Hufflepuff’s bets (skip nonces etc) we would have instantly realized he was cheating and we would have 2400+ more bitcoins. Hufflepuff only took a brief break from playing after we halved our max bet, I believe he would have cleaned us had we never discovered what was going on. We fund our own bankroll so no users were negatively impacted as a result of this.

Sorry for the long read,

Stunna & Primedice


Contact: Stunna@primedice.com