Satoshi Circle game is NOT provably fair.They use the following model:
1. The outcome of the game is fully determined by initial data in a way, known to the player.
2. Part of the initial data is provided by the player ("Client Seed").
3. For every possible variant of server's data, there exists a variant of player's data that makes player win.
4. The server proves that it didn't change its data after the player revealed his part of the initial data.
5. After the game, the player can compute the outcome himself and verify that it matches the actual outcome of the game.
I will show that the outcome is determined in an unknown way, which invalidates the provision (1).
Here is an excerpt from the algorithm published by Satoshi Circle:
function seedShuffle( $items, $seed ) {
if (is_numeric($seed)) {
$seedval = $seed;
} else {
$seedval = crc32($seed);
}
srand($seedval);
for ($i = count($items) - 1; $i > 0; $i--) {
$j = @rand(0, $i);
$tmp = $items[$i];
$items[$i] = $items[$j];
$items[$j] = $tmp;
}
return $items;
}This function is central in determining the outcome. It uses PHP functions
rand and
srand. The underlying PRNG algorithm has roughly as much influence on the outcome as the initial data.
This is the implementation of
rand in PHP 5.5.0 (ext/standard/rand.c):
PHP_FUNCTION(rand)
{
long min;
long max;
long number;
int argc = ZEND_NUM_ARGS();
if (argc != 0 && zend_parse_parameters(argc TSRMLS_CC, "ll", &min, &max) == FAILURE)
return;
number = php_rand(TSRMLS_C);
if (argc == 2) {
RAND_RANGE(number, min, max, PHP_RAND_MAX);
}
RETURN_LONG(number);
}
PHPAPI long php_rand(TSRMLS_D)
{
long ret;
if (!BG(rand_is_seeded)) {
php_srand(GENERATE_SEED() TSRMLS_CC);
}
#ifdef ZTS
ret = php_rand_r(&BG(rand_seed));
#else
# if defined(HAVE_RANDOM)
ret = random();
# elif defined(HAVE_LRAND48)
ret = lrand48();
# else
ret = rand();
# endif
#endif
return ret;
}
As you can see, it uses one of 4 possible PRNG functions. Which one is actually used, depends on the PHP build. One of the back-end functions,
rand (as defined by C standard), has implementation-dependent algorithm.
So, we have many possible PRNGs, and in fact, many different algorithms for computing the outcome.
How it theoretically can be used by Satoshi Circle to cheat. Suppose, a player makes one large bet, and it is his first bet. After the player discloses his "client seed", the server tries several PRNGs and uses one that gives
the worst outcome for the player. Then Satoshi Circle claims that it is "the" PRNG they use.
Also, even if PRNG algorithm was known to the player, it is still difficult to verify the outcome.
1. When I try to select the hash of the server data to copy-paste it, the "client seed" entry form pops up and the text that I try to select goes to background.
2. The scheme used to compute the outcome is excessively complex. There exists a scheme that would provide at least the same level of security for the Satoshi Circle and the player, do better randomization of the outcome, and is easy to compute by an average player.
3. To verify the outcome using the current scheme, the player needs exactly the same PRNG. It may be a considerable hassle to get one for some OSes.
That all
discourages players from verifying the fairness themselves. Most will hope that someone else will find it out if Satoshi Circle is cheating.
