[solved] vipgame.io claims to be fair but can't prove it

[LoyceV]

Update: solved! See dooglus' post!


I'd like to get some feedback from established members. In my experience, when a website owner/promotor evades critical questions, it's usually a smoking gun. However, this is not a scam accusation (yet).

Accounts involved:
Jr. Member Cherkez (thread archived)
Newbie vipgame (thread archived).

I'll quote the relevant (public) posts about this (I've shortened some of the quotes, and highlighted my main concern in red):
Q:

Yesterday, I tested your site and went all-in (with my free 0.0005BTC). It produced an error. I clicked again, and I lost the bet. That error made me question fairness, it doesn't look like something a user can avoid, which means it can be manipulated.

Question about fairness

VIPGAME uses the EOS transaction hash to generate its results, ensuring absolute fairness to all players.

EOS produces several blocks per second. I'm not familiar with using a blockchain as random input (it's the first time I see this implementation), so I have to ask: how can you ensure the bet uses the next block, and how can you guarantee I wouldn't just get an error if the result is in my favour? Or how can you guarantee you won't select one out of the next two results (in less than a second) after I click? The difference could be caused by lag, but it could also be manipulated. How can a player know for sure it's fair?

A:

The result of VIPGAME is determined by HASH and cannot be manipulated. There may be problems with the network or display. You can join the telegraph group https://t.me/vipgameio and directly report it to the administrator.

Q:

The result of VIPGAME is determined by HASH and cannot be manipulated.

That's not my question. I'm saying you can easily manipulate which hash is used, and you're just repeating the same as the website says.

There may be problems with the network or display. You can join the telegraph group https://t.me/vipgameio and directly report it to the administrator.

Can you get the administrator to respond here? You're promoting the site on Bitcointalk, I don't care about "the telegraph".

A:

Your question has been processed, you can view the VIPGAME wallet

Q:

That doesn't answer my question at all. So I take it you have no answer, and you can indeed manipulate which hash you use for a bet.

I don't believe any casino owner is dumb, so playing dumb makes me even more suspicious:
A:

Your question has been processed, you can view the VIPGAME wallet

That doesn't answer my question at all. So I take it you have no answer, and you can indeed manipulate which hash you use for a bet.

Each game result can be found and verified in the EOS main network section. Don't know why you feel that our results are manipulable? !
You can prove how we manipulate the results! If it's just because you lost, then I can't do anything about it.

I can only continue to talk about the content on the website: How are the Winning Numbers Generated?

DICE :
The winning number(00-99) is generated from the next block of the block contains your betting record.
For example, the player rolled under 50, the block that contained his betting information was 43116451.
So the winning number comes from the next block: 43116452.
BlockHash: 0291e7a49bd634fdb726c8b6f6a962b8959183aab4e929941f244b619f0506f7
Starting from the end, the 2 digits are 6 and 7. So the winning number was 67.

None of this answers my question. The site claims to have "Absolute Fairness", which they can't prove. The only way to use a future block hash as random outcome for any bet, is if you can be absolutely sure upfront which block is going to be used. In this case, you don't know that because the block hashes are produced very quickly.

[TwitchySeal]

Hopefully RHaver or Dooglus chime in here.  Their response would be a lot better than mine, so I'll wait and see if they do.

I don't believe any casino owner is dumb, so playing dumb makes me even more suspicious:

For once I have to disagree with you here.

[dooglus]

Hopefully RHaver or Dooglus chime in here.  Their response would be a lot better than mine, so I'll wait and see if they do.

Thanks for the ping.

I've not looked into their site, nor do I have any experience with EOS, but from what they say:

The winning number(00-99) is generated from the next block of the block contains your betting record

they're using the hash of the block which immediately follows the block containing your bet transaction, so they're not free to choose which hash they use.

Assuming that mining is hard enough that it isn't feasible for the site to attempt to manipulate the hash of the block which follows your bet transaction, this would appear to be fair enough.

The apparent avoiding of the questions may be due to them not fully understanding your concern. They don't write like a native English speaker. But the last past of your post seems pretty clear to me:

For example, the player rolled under 50, the block that contained his betting information was 43116451.
So the winning number comes from the next block: 43116452.
BlockHash: 0291e7a49bd634fdb726c8b6f6a962b8959183aab4e929941f244b619f0506f7
Starting from the end, the 2 digits are 6 and 7. So the winning number was 67.

[LoyceV]

they're using the hash of the block which immediately follows the block containing your bet transaction

Thanks for pointing this out. Until now, I overlooked the possibility to store the bet itself in a block too. I haven't checked if they really do it, but this takes away my concern: it is possible to do this in a provably fair way.

[RHavar]

Hopefully RHaver or Dooglus chime in here.  Their response would be a lot better than mine, so I'll wait and see if they do.

I don't really know anything about vipgame.io or much about EOS. But using the hashes as a source of entropy seems like a kind of terrible idea, and I believe was the root cause of how EOSPlay was "hacked" yesterday.

[khaled0111]

they're using the hash of the block which immediately follows the block containing your bet transaction

Thanks for pointing this out. Until now, I overlooked the possibility to store the bet itself in a block too. I haven't checked if they really do it, but this takes away my concern: it is possible to do this in a provably fair way.

I am not very experienced in this field, but how does that take away your concerns if you don't know exactly in which block your bet was stored?

EOS produces a block each 0.5 second. If you are a winner they can easily include your bet in the next block (it will take 1 second and you will not notice it). It can be manipulated unless you know exactly the block number beforehand.

Am I missing something!

[DarkStar_]

they're using the hash of the block which immediately follows the block containing your bet transaction

Thanks for pointing this out. Until now, I overlooked the possibility to store the bet itself in a block too. I haven't checked if they really do it, but this takes away my concern: it is possible to do this in a provably fair way.

I am not very experienced in this field, but how does that take away your concerns if you don't know exactly in which block your bet was stored?

EOS produces a block each 0.5 second. If you are a winner they can easily include your bet in the next block (it will take 1 second and you will not notice it). It can be manipulated unless you know exactly the block number beforehand.

Am I missing something!

I believe that once the transaction is confirmed by a miner (or whatever they call them in EOS), vipgame.io processes the bet. vipgame.io likely is not a miner/has no power to include transactions, so they can't influence anything. Players can also check on the blockchain to see which block their transaction was confirmed in.

Hopefully RHaver or Dooglus chime in here.  Their response would be a lot better than mine, so I'll wait and see if they do.

I don't really know anything about vipgame.io or much about EOS. But using the hashes as a source of entropy seems like a kind of terrible idea, and I believe was the root cause of how EOSPlay was "hacked" yesterday.

If it's not too complicated, mind explaining why? I'm genuinely curious and can't seem to find any info after a quick google search.

[suchmoon]

can't seem to find any info after a quick google search

https://medium.com/@dexaran820/eos-congestion-9-13-2019-and-eosplay-hack-cbafcba2d1dc

[dooglus]

I am not very experienced in this field, but how does that take away your concerns if you don't know exactly in which block your bet was stored?

EOS produces a block each 0.5 second. If you are a winner they can easily include your bet in the next block (it will take 1 second and you will not notice it). It can be manipulated unless you know exactly the block number beforehand.

Am I missing something!

What you're missing is that they don't store your bet in a block, the miners do. It would be possible to manipulate the results if you had a lot of hash power and were willing to use it to 51% attack the network.