Breaking: Shuffle-based Provably Fair Implementations Can Cheat Players (proof)

[TrevorXavier]

Yea, makes total sense...

And sorry I'm skeptical, I guess I'm just being dense here, but would love to see a video show that you can produce such kind of rigged decks with a truly random client seed with 100% success.

Example - Blackjack
You want to show the dealer always gets a "20" with first 2 cards. Using provably fair shuffle, and ANY client seed you can achieve that repeatedly?

So, maybe I'm not reading it correctly, but the idea is not to produce a deck that wins every single time, if that's what you meant by "100% success." Rather, to produce a deck that causes the player to lose more than the expected average. In other words, you're not looking to have a dealer 20 every time, just perhaps more often.

Imagine we're playing 6-deck blackjack described at the Wizard of Odds. For each hand, the net summarized win is as follows: player wins 42.42% of the time, pushes 8.48% of the time, and loses 49.09% of the time. What shufflepuff can do is create decks that incrementally perform like this:

Average: win 42.42%; push 8.48%; loss 49.09%
Iteration n: win 41.20%; push 8.50%; loss 50.3%
Iteration n + p: win 40.85%; push 8.62%; loss 50.53%
Iteration n + p + q: win 39.10%; push 8.75%; loss 52.15%

When you use iteration n + p + q, there will be seeds where the dealer loses (player wins), but the player will lose more often than before (on average). So, using this arrangement, the casino can permanently alter the house edge.

[JackpotRacer]

I think that would be extremely valuable... also, how would a 'rigged casino' account for games that have unexpected customer behaviors? Like hitting or staying in Blackjack, or going randomly red / black in roulette?

Not discounting what you're saying technically, but I just don't see how a rigged casino could account for these variables.

Yes, so that's part of the heuristic I mentioned earlier. There are games, such as roulette, which require play history. However, there are others, such as blackjack, that are exclusive. The exploit works regardless. In addition, you don't really need to account for 'strange' plays, as the goal is to reduce favorable cards for the player, or encourage favorable cards for the dealer. Since the dealer doesn't play strangely, the exploit works. Here's a brief overview:

Roulette

• Optimizations: favor one color over another; favor thirds; favor number; reduce instance of number, color, or third.
• Heuristic: Brute-force. The arrangement space is computationally feasible.
• Deployment: Requires at least one game played to stack decks.

Blackjack

• Optimizations: player receives bust hand (13-16); deny player ace; house starts with 10, Ace, or non-bust card; reduce splitting; reduce doubling; reduce dealer busts, and more
• Heuristic: Create translation decks using the seed space. Since most blackjack games average 6-7 cards total dealt, attempt to optimize by best-fit.
• Deployment: Mutually-exclusive. Exploit works regardless of prior play.

For blackjack, you're not necessarily attempting to combat random play (random hits, random doubles), but rather, encourage favorable cards to the dealer and encourage bad cards for the player. So, you're looking for arrangements that give the dealer an Ace more often than not, give the player a 6, reduce the likelihood of splitting, doubling, and so on. Beyond that, you'd want to allow for the house to make their hand (try to keep a slug of low cards beyond the 7th position of the final deck, etc.). You can also optimize to combat basic strategy and 'upgrade' the cold decks when prior play history suggests the player is playing this way.

Blackjack works due to the extremely large arrangement space. You're talking 416! / 128! / (32!)⁹ possible arrangements in an 8-deck game. Since your target is only 2³², that means you need to find an arrangement that works well against the 2³² / (416! / 128! / (32!)⁹) shuffles in the final space. The number is so small that most calculators can't even represent it. It's possible there exists an arrangement that beats all possible seeds.


Video Poker

• Optimizations: encourage dead hands for the first 10 cards; reduce royal flush, straight flush, and so on; allow for good primary hands (like four to a straight flush), but deny matching card, and more
• Heuristic: Create translation decks using the seed space. Reduce translations to first 10 cards and attempt a best-fit optimization.
• Deployment: Mutually-exclusive. Exploit works regardless of prior play.

This is just a partial list. I'll elaborate more when I publish the optimized decks. This is pretty much where I started when I attacked the problem.

Addendum: Also, remember, the goal of shufflepuff is to not discover the uber-optimized deck, just ones that perform better than others. So, a casino operator performing a random search would probably do well in the short term with shufflepuff vs. hiring a mathematician to construct a heuristic.

after reading this it is clear that Black Jack is best game to cheat ( for a provably fair casino )

it is like some casinos took out some 10 value cards to the decks to get an advantage or players added some cards to the decks to get an advantage without counting

thx for this detailed explanation

[casinobitco]

I'm still not following: With the user providing a random client seed (which is used for the final shuffle); how can your shufflepuff algorithm predict with precision that it will serve up the rigged deck?

I'm not discounting a site like Bitzino (or even ours) couldn't rig shuffles, as both sites produce the first shuffle and client seed - but if the user changes the client seed (which they are absolutely always encouraged to do, otherwise what's the point of even playing a provably fair game?), how can you predict the final shuffle (with the new, random, client seed) would in fact still be 'rigged'?

Yea, makes total sense...

And sorry I'm skeptical, I guess I'm just being dense here, but would love to see a video show that you can produce such kind of rigged decks with a truly random client seed with 100% success.

Example - Blackjack
You want to show the dealer always gets a "20" with first 2 cards. Using provably fair shuffle, and ANY client seed you can achieve that repeatedly?

So, maybe I'm not reading it correctly, but the idea is not to produce a deck that wins every single time, if that's what you meant by "100% success." Rather, to produce a deck that causes the player to lose more than the expected average. In other words, you're not looking to have a dealer 20 every time, just perhaps more often.

Imagine we're playing 6-deck blackjack described at the Wizard of Odds. For each hand, the net summarized win is as follows: player wins 42.42% of the time, pushes 8.48% of the time, and loses 49.09% of the time. What shufflepuff can do is create decks that incrementally perform like this:

Average: win 42.42%; push 8.48%; loss 49.09%
Iteration n: win 41.20%; push 8.50%; loss 50.3%
Iteration n + p: win 40.85%; push 8.62%; loss 50.53%
Iteration n + p + q: win 39.10%; push 8.75%; loss 52.15%

When you use iteration n + p + q, there will be seeds where the dealer loses (player wins), but the player will lose more often than before (on average). So, using this arrangement, the casino can permanently alter the house edge.

[RHavar]

I actually did hit the modulo bias quite often, since I'm searching the entire space. I think it's silly that bitZino even had a modulo bias. It's a casino. Quick and easy fix:

I was just referring to my version, moduloing a random 2^256 number by <a small number> is going to be for all intents and purposes perfectly distributed.



Also, I think you're grossly overestimate the risk in releasing your code -- it's not a huge task to write, and I really doubt it's worth the effort to even implement (assuming you were a psychotic casino owner), unless you were running a 0 edge game. (If you assume that user play is loss-constrained, it's **better** for a casino to have a lower edge). That's not an excuse, and casinos should definitely fix it. But it's not like casinos are going to be scrambling to rip off players

[JasonXG]

I agree with you, because who sets the order and picks which "provably fair" roll goes in which order. We don't know when they are generated or even how. I mean sure they random but they can tip towards choosing a certain hash.

[RHavar]

I'm still not following: With the user providing a random client seed (which is used for the final shuffle); how can your shufflepuff algorithm predict with precision that it will serve up the rigged deck?

I'm not discounting a site like Bitzino (or even ours) couldn't rig shuffles, as both sites produce the first shuffle and client seed - but if the user changes the client seed (which they are absolutely always encouraged to do, otherwise what's the point of even playing a provably fair game?), how can you predict the final shuffle (with the new, random, client seed) would in fact still be 'rigged'?

I think the original post is very well articulated, far better than I could, so I feel a bit bad trying to repeat it. But the point that some provably fair systems are kind of stupid and only allow 2^32 combinations -- which is small enough you can literally just try them all. If > 2^31 of the final outcomes are good for the house, then the house knows that it'll have an increased house edge by using that initial shuffle.

So really it's not a problem with provably fair, just bad ones. Provably fair systems like bustabit already prevent against precomputing a favorable initial seed. For a shuffling one, you just need to use logic that gives a shit load more possible final shuffles. (I recommend the pseudo code in my previous post, which shouldn't reduce the space at all)

[casinobitco]

I'm still not following: With the user providing a random client seed (which is used for the final shuffle); how can your shufflepuff algorithm predict with precision that it will serve up the rigged deck?

I'm not discounting a site like Bitzino (or even ours) couldn't rig shuffles, as both sites produce the first shuffle and client seed - but if the user changes the client seed (which they are absolutely always encouraged to do, otherwise what's the point of even playing a provably fair game?), how can you predict the final shuffle (with the new, random, client seed) would in fact still be 'rigged'?

I think the original post is very well articulated, far better than I could, so I feel a bit bad trying to repeat it. But the point that some provably fair systems are kind of stupid and only allow 2^32 combinations -- which is small enough you can literally just try them all. If > 2^31 of the final outcomes are good for the house, then the house knows that it'll have an increased house edge by using that initial shuffle.

So really it's not a problem with provably fair, just bad ones. Provably fair systems like bustabit already prevent against precomputing a favorable initial seed. For a shuffling one, you just need to use logic that gives a shit load more possible final shuffles. (I recommend the pseudo code in my previous post, which shouldn't reduce the space at all)

OK, I follow that. Let's talk practical --- are there really 2^31 outcomes that are good for the house (only) in Blackjack, Roulette, Video Poker?

Still would love seeing some real proof where I can change the client seed to anything I want, and still get one of those 'rigged' shuffles; otherwise this is just a thread with a ton of people (not you, or the OP) chiming in who have no understanding of how math or provably fair works.

 

[dothebeats]

The last line of your (trevor) post hit me big. From the start, I don't really like playing shuffle-based games (like baccarat, card games or the likes), as I thought that they can be somewhat rigged. Well, turns out that I'm right on my thoughts after all, but with that I'd like to see a video demo of the exploit as "provably fair" casinos seemed to not be fair at all.

Thanks for the feedback!

I thought about doing a video, but didn't really know if it would cultivate interest. I'll rethink the idea. Might be nice seeing the exploit visually.

It would probably gain interest from the peers and casino owners, seeing that there is a possibility that shuffle-based games could be exploited after all. I'm still a bit confused on how would that work exactly, given that I don't have a deep knowledge on how does shuffle-based games work technically.

[RHavar]

OK, I follow that. Let's talk practical --- are there really 2^31 outcomes that are good for the house (only) in Blackjack, Roulette, Video Poker?

Yes. For every initial shuffle you try, there will be a ~50% chance, that it is more biased to the house than expected. So it's an extremely practical attack, in that sense. And you could also precompute a bunch of "bad shuffles" which you potentially serve to high-rollers. It's 100% transparent, so that's what makes it insidious.  The thing is that it's a weakness of provably fair systems that use this method, so they should simply be fixed.


But the impact however, is pretty minor I suspect. I'm guessing that BJ is going to be the most vulnerable game (because it draws so few cards), and I'd honestly be shocked if you can find an initial shuffle that gives the house more than an extra ~0.1% edge.  (Although I might be wrong, I'm just pulling a number from my ass)

[RHavar]

I'm still a bit confused on how would that work exactly, given that I don't have a deep knowledge on how does shuffle-based games work technically.

It's really just a problem with *bad* shuffles.  After you shuffle an "initial deck" of cards, a good shuffle will give you a possible 52! arrangements (or as close to it as possible). 52! is a mind boggling big number ( 80658175170943878571660636856403766975289505440883277824000000000000 ) but if you're using a shitty shuffle, there will only be 4294967296 possible results, which small enough you can feasibly try them all and see if the initial shuffle is good, bad, great or terrible.

[RGR991]

No doubt that some(not all) of these "provably fair" casinos have utilized a technique like this to "increase" the house edge....

Its funny to me since most bitcoin casinos offering BJ offer terrible rules anyway + human error, is that not enough for some of them...

There needs to be a fix to eliminate this "deck stacking" and users need to avoid any casino that does not utilize the fix.


Otherwise provably fair is just a fancy word while the casino robs you blind.  


Another thing that I have always been curious about is how can you tell for sure that the "randomly generated" client seed is really randomly generated..is there any way to really tell..such a pain to change it manually every time and if this post from the OP is all true it makes no difference.

[JackpotRacer]

No doubt that some(not all) of these "provably fair" casinos have utilized a technique like this to "increase" the house edge....

Its funny to me since most bitcoin casinos offering BJ offer terrible rules anyway + human error, is that not enough for some of them...

There needs to be a fix to eliminate this "deck stacking" and users need to avoid any casino that does not utilize the fix.


Otherwise provably fair is just a fancy word while the casino robs you blind.  


Another thing that I have always been curious about is how can you tell for sure that the "randomly generated" client seed is really randomly generated..is there any way to really tell..such a pain to change it manually every time and if this post from the OP is all true it makes no difference.

yes this what we would like to see!

There needs to be a fix to eliminate this "deck stacking" and users need to avoid any casino that does not utilize the fix.

[NLNico]

I guess the fix seems easy.

Now they use Fisher–Yates shuffle with Mersenne Twister RNG.

They should use Fisher–Yates shuffle with "modulo of sha256 RNG".

But TrevorXavier said he will still give his implementation, so we can wait for that too

[NLNico]

Another thing that I have always been curious about is how can you tell for sure that the "randomly generated" client seed is really randomly generated..is there any way to really tell..such a pain to change it manually every time

You will have to be a programmer to be able to see if the clientseed was really generated in a cryptographically secure way in your browser (after getting the serverseed hash already.)

That's why changing clientseed manually is still better.

That's also why the "nonce implementation" is preferred since you only need to change it once and u can make as many bets as you like. Not like the "per roll implementation" where you indeed have to change the clientseed every bet.





There is some more specific advantages/disadvantages to that, for example a script/bot should be able to work more easily with the "per roll implementation". Also in reality with the "nonce method" you make like 1000 bets but only verify that last 10 losing streak.. so still not perfect. But I really believe on average "nonce method" is better.

[bad_ip]

Potential solution is to let the user "cut" the randomized set to determine the starting place.

Might be a bit of a UI nightmare though.

[JackpotRacer]

Potential solution is to let the user "cut" the randomized set to determine the starting place.

Might be a bit of a UI nightmare, but fair none the less.

don't think a cut will help but a reshuffle could help as in real life

[bad_ip]

Potential solution is to let the user "cut" the randomized set to determine the starting place.

Might be a bit of a UI nightmare, but fair none the less.

don't think a cut will help but a reshuffle could help as in real life

I think either works tbh.

[JackpotRacer]

Potential solution is to let the user "cut" the randomized set to determine the starting place.

Might be a bit of a UI nightmare, but fair none the less.

don't think a cut will help but a reshuffle could help as in real life

I think either works tbh.

the cut is never enough believe me and even with a reshuffle the player needs to be sure that the decks are exactly as they should be and no cards taken out or added

[bad_ip]

Potential solution is to let the user "cut" the randomized set to determine the starting place.

Might be a bit of a UI nightmare, but fair none the less.

don't think a cut will help but a reshuffle could help as in real life

I think either works tbh.

the cut is never enough believe me and even with a reshuffle the player needs to be sure that the decks are exactly as they should be and no cards taken out or added

For multi-draw results I see your point.  

[hatshepsut93]

Another important threat in the bitcoin space is investment based sites, there's absolutely no way to know if the owners will play against the house and steal from investors in an undetectable manner.

Can't agree more. I am not sure if many investors are aware of this possibility especially the ones with relatively high Profit/EV.

Stunna always bashes crowdfunded bitcoin casinos.

I can see why but people are smarter now and no one is investing large amounts in new sites with questionable owners who are likely to scam (Dicebitco.in and dice.ninja).
I wonder what his honest opinion is on BetKing.io/me when it comes to trust and investing.

But your argument doesn't make much.
If the Profit/EV is high then it is far less likely that the owner has been cheating the investors. If the owner was cheating then the Profit/EV would be lower.

Of the 5 Bitcoin investment sites on dicesites.com only 2 are under EV and people could accuse them of playing against investors.

People think SafeDice is legit though and is just below EV because of their risky invest model and were unlucky.

I've never trusted Bitdice so I won't go into that.

BetKing.io has a profit/ev of 140% so it strongly suggests that there is no cheating going on of investors.
Good job it's also provably fair so you can prove the house hasn't cheated players too

I've proved over and over that your funds are safer in BetKing than any other crowdfunded casino and it is a fact that it is the most trusted.
Primedice is certainly more popular but Stunna doesn't secure as many Bitcoin of other users as BetKing does at one time.
Though he may very hold more than the whole of BetKing in his own personal wallet

Moneypot looks like it might be safe to invest in as a couple of their owners (not all) are respectable members of the community, though the owners have only had it for 5 months so who knows.

SatoshiDice you would think would be safe since they have been around a long time but it seems common knowledge that they have changed owners more than a few times.

In response to OP. That is an interesting claim and I will look in to it a bit more. It would be good to see some ideas of solutions to the problem.

As long as investors don't have their part of control over random seeds, there is no way to be sure that they are not robbed. Ofc no one will invest in casino with negative monthly profits, but still it's quite possible that somewhere investors are robbed of their share, and it's completely undetectable. Reputation wouldn't mean much, because there's almost zero risk of being caught doing it.