PevPot :: The first +EV lottery (Call for sponsors!)

[RHavar]

Thanks for the early sponsors! Locking, to create the main thread now!


Hi guys,

In a few hours, I'll be launching my newest project PevPot.com which is going to be the first ever +EV lottery

The way it works is pretty simple, everyone sends bitcoins to a lottery address and for every satoshi you send you get 1 chance of winning. Every 1000 blocks (~7 days), we use the block hash to find a winner (with our provably fair). So if there's a total of 100 BTC sent, and you sent 0.03 BTC you would have a 0.03/100 chance of winning, and if you win you get the ENTIRE pot PLUS  "sponsorship" money. This means players get better than their the "fair odds" of winning, making it +EV

So what's sponsorship money? Basically a way for advertisers to get noticed. The top 5 sponsors of every draw (it's an auction) are prominently displayed during the draw (and forever in the history). 90% of the money that sponsors pay goes into the prize pot (that's what makes it +EV) and the remaining 10% I get to keep (my business model).

The site will soft-launch in a couple hours (bitcoin block) 383000, so if you want a chance to become a sponsor for the first ever draw now's your chance to throw a few bitcents and make history:

https://www.pevpot.com/sponsor

Images are the same size as: https://thebitcoinstrip.com/  if you need a place to grab one from


(Note: The first draw I intend to be pretty relatively low key, as I want to iron out all the issues with it, and release some independent verification tools and what not)

[1714936896]

1714936896

[1714936896]

1714936896

[1714936896]

1714936896

[1714936896]

1714936896

[1714936896]

1714936896

[dooglus]

we use the block hash to find a winner (with out provably fair)

Is that a typo? Do you mean "without"? Using the block hash is provably fair unless you think a miner is going to withhold a block (and lose 25 BTC) to have a better chance of winning.

The site will soft-launch in a couple hours (bitcoin block) 383000

So the first draw will about a week from now, at block 384000?

[RHavar]

Is that a typo? Do you mean "without"?

Typo for "with our" 

So the first draw will about a week from now, at block 384000?

That's correct.

[dooglus]

Is that a typo? Do you mean "without"?

Typo for "with our" 

You should spellcheck the site:

"you can both recieve and sign a message"

[RHavar]

unless you think a miner is going to withhold a block (and lose 25 BTC) to have a better chance of winning.

This is something I've been thinking about. There exists a certain point where if you had a miner with a sufficiently large percent of the bitcoin hashing power, and a sufficiently large amount of a huge pevpot draw, they would be ncentivized to discard their solved block (and lose 25 btc) rather than lose the pevpot draw. When this become a remote reality, I think I have a nice idea for how to solve for it:

Instead of using the blockhash directly, apply an extremely time-consuming function on it.  Something that is not parallelizable, and would take a modern computer a significant amount of time to compute (e.g. bcrypt with hundreds of millions of iterations). Ideally though a function where verification is cheaper than the original computation. This could quickly make it uneconomical for a miner to check if their block has won or not, as it would almost guarantee their block gets orphaned.

[dooglus]

Instead of using the blockhash directly, apply an extremely time-consuming function on it.  Something that is not parallelizable, and would take a modern computer a significant amount of time to compute (e.g. bcrypt with hundreds of millions of iterations). Ideally though a function where verification is cheaper than the original computation. This could quickly make it uneconomical for a miner to check if their block has won or not, as it would almost guarantee their block gets orphaned.

That's a good solution. I'm curious to know if you have such a function (easy to verify) in mind.

An almost-but-not-quite solution would be to hash (blockhash + nonce) with nonce=0, 1, 2, ... until the hash starts with a suitable number of zeroes, and then use hash(hash(blockhash+nonce)) as the number to determine the winner. Then you search for the nonce and publish it along with the blockhash.

It's easy to verify that the published nonce gives the correct number of prefix zeroes, but it's not easy to verify that it is the lowest such nonce.

Can you do better?

--

"All transactions that are included in the draw are first sorted by their hash (txid)" -- a few nitpicks that it's probably worth clarifying: you don't say anything about how many confirmations a deposit needs to be included in the draw. What do you do if block xxx000 is reorged out of the chain by a different xxx000, changing which transactions are considered part of the draw. What about transaction malleability? I presume you use the txid as it shows up in the blockchain, rather than the txid your client saw first.

[BetterBets.io]

I like the concept and will participate as a sponsor, great work so far here Ryan

[RHavar]

That's a good solution. I'm curious to know if you have such a function (easy to verify) in mind.

The best I have for now is just "bcrypt with millions of iterations". The nice thing about this, is you can't parallelize it, which means you can make a very good estimate of the amount of time it would take to solve. Even if it took people ~30 minutes to solve, it'd be a bit inconvenient to verify, but not show-stoppingly so.  

you don't say anything about how many confirmations a deposit needs to be included in the draw.

Thanks, I'll add this. As long as it gets confirmed on or before the draw hash, it counts. If it doesn't get confirmed by the draw hash, it'll just be part of the next draw. (I will reuse the lottery address, specifically for this reason)


In the case of reorgs, the hash is used from the chain with the most work. No payments are automatic (the lottery address is part of my cold wallet) and won't be sent immediately (I want to give people time to verify the draw outcome before I sent payment) so it won't really be an issue. Worst case is someone will think they won, then there will be a re-org and a different winner is picked =)

(I believe this is really the only way to do it provably fairly, otherwise if there was a block race it's not possible for me to prove I saw X before Y)

[RayBrady]

A very unique idea once again from Ryan. Of course I will participate in this . I think it will be successful as with everything you make . Good luck with it!

[NLNico]

Sounds good!

I have been waiting for a good lottery for a long time (did join that one of Dabs 2 years ago but that died in activity.) I hope it reaches high prices and you don't make it too frequently (once a week sounds good.)