Introducing PevPot.com The Bitcoin Lottery

[RHavar]

PevPot.com is a project that I've been working on for a few weeks now, and believe it to be the first of its kind. It's a provably fair lottery where players actually get more out than they put in. Or said more technically it's the holy grail of gambling: +EV

The way that it works is pretty simple, each draw is sponsored by a number of advertisers, who make this possible. 90% of the money the sponsors pay goes directly into the prize pot (we keep 10%). 100% of the tickets players buy go into the prize pot. For every satoshi you send, you get 1 ticket. And every 1000 bitcoin blocks (when it ends in 000) we draw a winner (in a provably fair way, of course).

For more details, please see pevpot.com.

(Also a big thanks to our sponsors who with only a couple hours notice helped make the first draw happen.

I look forward to your feedback. Please buy tickets, share with your friends and support our sponsors who make this possible!

[1713921031]

1713921031

[1713921031]

1713921031

[1713921031]

1713921031

[1713921031]

1713921031

[1713921031]

1713921031

[dooglus]

So I was thinking about the provable fairness, and how to prevent the miner from gaining an edge by withholding his block if it causes him to lose.

If a miner has a sufficient amount of hashing power, and a sufficient amount of pevpot tickets and the pevpot prize pot is big enough it could theoretically be advantegous for a miner to discard a valid bitcoin block if that block would to them losing the pevpot draw. If this theoretical attack looks like it could be a concer, the most obvious fix would be to change verification to be an extremely time-consuming process (e.g. bcrypt the block hash with millions of iterations) so that it would be infeasible for a miner to check if their block won or not (without getting orphaned). If you have any ideas for this, we'd love to hear your input on the forum.

I bolded some typos.

I'm trying to think of a method that prevents the miner from instantly knowing whether his newly solved block results in him winning the lottery or not, without also making the verification of the provable fairness overly burdensome for the players. The bcrypt idea above has the problem that everyone attempting to verify the result also has to run millions of iterations of bcrypt.

I came up with this:

You know how it's really hard to go from a Bitcoin public key to a Bitcoin private key (like *really* hard), but very quick and easy to go the other way... Could we use the same idea but made easier to solve this problem?

Instead of using the secp256k1 curve that Bitcoin uses, use a 48 bit curve or some such, and treat the last 48 bits of the miner's block hash as the public key. Then the proof-of-work to determine the winner involves searching for the corresponding 48 bit private key. Once found, append the private key to the block hash, hash the result, and that's your 256 bit value for deciding who won.

The advantage of this method over the million-bcrypts method is that it takes no work for anyone to verify that the private key matches the public key, but it takes a lot of work to go the other way.

Oh, but it has two problems:

1) the search is easily parallelized - so someone with a lot of hardware (a miner, say) could search quicker than others
2) I'm not sure that there's any guarantee that there's only one private key for each public key

I wonder if it's possible to find a solution which isn't able to be parallelised, takes a long time to solve, but no time to verify.

http://crypto.stackexchange.com/a/9331 looks promising. It gives us:

* slow for the miner to compute
* quick for the users to verify
* not possible to parallelize

but with the disadvantage of the pevpot site having to keep a secret until after the draw, and being able to cheat (by removing the slowness) if it colludes with a miner

[BTC Tipster]

Nice project, fix this  https://www.pevpot.com/how-to-play
It shows provably fair box twice.

Good luck!

[dooglus]

More typos:

"This can only be done from a bitcoin wallet which you can both receive and sign a message from the sending address" -- you mean "with which ..." I think. But even then that's a confusing sentence.

"for every satoshi sent, is one chance of winning" -- that's not grammatical either

"So lets say you send 0.01 BTC" -- "let's"

"This transaction is the wining transaction"

[gampher]

i dont understand the " signing message " thing ?
why would you require it ?

[RHavar]

Thanks for the proof-reading Dooglus, I'll pushed up some fixes  

I wonder if it's possible to find a solution which isn't able to be parallelised, takes a long time to solve, but no time to verify.

http://crypto.stackexchange.com/a/9331 looks promising. It gives us:

* slow for the miner to compute
* quick for the users to verify
* not possible to parallelize

but with the disadvantage of the pevpot site having to keep a secret until after the draw, and being able to cheat (by removing the slowness) if it colludes with a miner

This is quite interesting, as it's basically like having a "server secret" that I don't need to worry about losing. But if the amounts in the lottery are sufficiently large that this is an issue, I believe the issue of "pevpot colluding with a miner" would be problematic. So I would steal lean towards a function that took an hour of computation time to verify (and compute initially). I've spent a while looking, but haven't found a function that satisfies:

* Is not parallelizable
* Slow to compute, fast to verify
* Offers no collusion possibility (i.e. no server secret)

any 2/3 however seems easy =)

[RHavar]

Nice project, fix this  https://www.pevpot.com/how-to-play
It shows provably fair box twice.

Good luck!

Each column is supposed to be a different way of playing. But seems that page is a bit too complex, I'll totally overhaul it tomorrow =)

[RHavar]

i dont understand the " signing message " thing ?
why would you require it ?

I cover it here: https://www.pevpot.com/faq#signing

But a huge reason is help protect people from themselves, while still being provably fair.  Actually already someone has played the lottery directly from their bustabit account (instead of using the forwarding feature). If I blindly returned money to the sending address, it'd end up in someone else's account.  Now if that transaction wins the lottery, I can actually take the time to sort it out. For instance what I'll do on behalf of the user is generate a signed message from the sending address which direct proper payment and then I can then publish the signed message (so you can verify I sent to the right spot).

[XinXan]

So how does the +EV work exactly? For every satoshi I send I get 1 ticket but anyone can send any amount and there is no limit so my chances of winning will always be variable, right? How can you know if it's going to be +EV if everytime im going to have different chances of winning?

[gampher]

i dont understand the " signing message " thing ?
why would you require it ?

I cover it here: https://www.pevpot.com/faq#signing

But a huge reason is help protect people from themselves, while still being provably fair.  Actually already someone has played the lottery directly from their bustabit account (instead of using the forwarding feature). If I blindly returned money to the sending address, it'd end up in someone else's account.  Now if that transaction wins the lottery, I can actually take the time to sort it out. For instance what I'll do on behalf of the user is generate a signed message from the sending address which direct proper payment and then I can then publish the signed message (so you can verify I sent to the right spot).

yeah but why would people send it from their bustabit accounts ? i mean they clearly cant sign a message from there.
you can restrict them to use only home wallet's or blockchain ..etc.
people lose their wallet and addresses many times and also export keys for several reason's .
it's tricky .

[RHavar]

yeah but why would people send it from their bustabit accounts ? i mean they clearly cant sign a message from there.

Yet people will do it anyway. I've probably had >25 support tickets from people withdrawing from their bustabit accounts to on-chain gambling games like satoshidice / satoshibones / lucky.bit even despite:

you can restrict them to use only home wallet's or blockchain ..etc.
people lose their wallet and addresses many times and also export keys for several reason's .
it's tricky .

In all those cases, users should be able to easily sign a message and direct payment of the prize if they win (including direct to their cold storage).


The idea is that the weekly prize amounts are supposed to be significant amounts of money, and I don't want to blindly send them hoping they arrive in the right spot. It also allows me to do the forwarding-addresses (pevpot.com/play) more efficiently, because when I generate the forwarding address I immediately sign (and save) a message directing proper payment.

[RHavar]

So how does the +EV work exactly? For every satoshi I send I get 1 ticket but anyone can send any amount and there is no limit so my chances of winning will always be variable, right? How can you know if it's going to be +EV if everytime im going to have different chances of winning?

Because for instance in this draw (#1) the prize is always going to be 0.17658 BTC more than players put in (thanks to the sponsor). So as more and more tickets are bought, the EV will get closer and closer to 0 but it'll always stay positive

[gampher]

The idea is that the weekly prize amounts are supposed to be significant amounts of money, and I don't want to blindly send them hoping they arrive in the right spot.

but it might be a problem if the user wins and is not able to sign a message ....or the alterative could be that the user can sign a message from the sending addy in case of any loss of wallet or addy's, In that case you need to remove the date and time thing .
however it is lesslikely to happen but it is possible.

[RHavar]

but it might be a problem if the user wins and is not able to sign a message ....or the alterative could be that the user can sign a message from the sending addy in case of any loss of wallet or addy's, In that case you need to remove the date and time thing .
however it is lesslikely to happen but it is possible.

If a user is not able to sign a message, they should be using the forwarding feature (pevpot.com/play) which does it all automatically for you. But if there's any problems with the winner signing a message, I'm more than happy to work with them to make sure the money arrives in the right hands. The point of the signed message isn't to be an obstacle, it's designed to stop mistakes =)

[XinXan]

So how does the +EV work exactly? For every satoshi I send I get 1 ticket but anyone can send any amount and there is no limit so my chances of winning will always be variable, right? How can you know if it's going to be +EV if everytime im going to have different chances of winning?

Because for instance in this draw (#1) the prize is always going to be 0.17658 BTC more than players put in (thanks to the sponsor). So as more and more tickets are bought, the EV will get closer and closer to 0 but it'll always stay positive

Oh I see, so basically if I were to play alone no matter how many bitcoins i send the sponsors are always going to send more. Seems pretty nice, hopefully it's +EV for you too in the long run.

[gampher]

but it might be a problem if the user wins and is not able to sign a message ....or the alterative could be that the user can sign a message from the sending addy in case of any loss of wallet or addy's, In that case you need to remove the date and time thing .
however it is lesslikely to happen but it is possible.

If a user is not able to sign a message, they should be using the forwarding feature (pevpot.com/play) which does it all automatically for you.

sounds quite comfortable than the previous deal, there should be an alternate always.

[Joel_Jantsen]

How come its probably fair when you choose only 1 winner ?If 1000 people buys tickets and only 1 is winning then the probability of win is almost 1/1000 which is completely random .You should have atlest first seocnd  and third place winners as well

[ndnh]

How come its probably fair when you choose only 1 winner ?If 1000 people buys tickets and only 1 is winning then the probability of win is almost 1/1000 which is completely random .You should have atlest first seocnd  and third place winners as well

It is provably fair lol.

It means the lottery result can be independently verified, that is, the fairness is provable.

[RHavar]

How come its probably fair when you choose only 1 winner ?If 1000 people buys tickets and only 1 is winning then the probability of win is almost 1/1000 which is completely random .You should have atlest first seocnd  and third place winners as well

I'm a bit of a sucker for simplicity, so I do like the idea of "winner takes all". Provably fair doesn't imply that you're probably going to win, it just means that you can verify it's fairness. =)

(i.e. For $1 if you have a 1 in a million chance of winning a million dollars, you're probably not going to win .. but it's still fair)

[dooglus]

Oh I see, so basically if I were to play alone no matter how many bitcoins i send the sponsors are always going to send more.

No, the amount the sponsors add is fixed before each round begins.

This week the sponsors are adding 0.17658 BTC.

If you play alone, and bet 1 BTC, you get back 1.17658 BTC. That's 0.17658 BTC more than you bet.

If you play alone, and bet 1000 BTC, you get back 1000.17658 BTC. That's 0.17658 BTC more than you bet.

See how that works? The prize pool is bigger than the sum of the bets by a fixed amount, so the game is +EV to play.

Seems pretty nice, hopefully it's +EV for you too in the long run.

The game itself is +EV for Ryan, since he has no risk and gets 10% of the sponsor money. But then he has to pay for hosting and other expenses out of that. I would guess there's quite a low cap on how much people are willing to pay as sponsors, and so quite a low cap on Ryan's take from the site. I can imagine the pot itself growing quite large, and Ryan making very little from it. But ass we see from bustabit he's probably happy taking a small amount.