FlipTheBitcoin.com - Double Your Bets - 50/50 Chances

[Suushi]

Hey guys!

I had some free time and I decided to create a simple Bitcoin game called "Flip The Bitcoin".

Address: http://flipthebitcoin.com

This game is still in beta state and I'm looking for people who are interested in helping me with testing this game. Please tell me when you find something suspicious or some holes in the game.

It basically works exactly like a real coin flipping game. You flip the coin and if that side lands that you chose you will win and double your bet that will be added to your balance.

If you are ready to withdraw your winnings, just go to withdraw page and your Bitcoins will be sent to your address instantly.

---

One of the reasons besides the free time was to collect money to our local dog shelter. So all the money that doesn't go to the winnings will go to our local dog shelter.
If I collect enough money, I will post pictures/videos as well.

---

If you have questions, please PM me here, answer to this post or email me: support - at - flipthebitcoin - com

---

For beta testers:

Please email me all the bugs that you can find.
Also if you are interested in translating this game into your language, please email me.

---

For supporters:

Please put the following code to your signature:

Code:

[url=https://bitcointalk.org/index.php?topic=186637.0]FlipTheBitcoin.com - Double Your Bets - 50/50 Chances[/url]

---

People I would like to thank for help:

TradeFortress - For being rude, but pointing out the problems

Thank you in advance

[BRules]

"Our system will remove your
balance in 24 hours after playing.
We do it to protect players."

Can you explain in more details this sentence?

[🏰 TradeFortress 🏰]

EDIT: Pwnt. Seriously, a site handling money of any kind should not be your first project.

Give a man a fish and you feed him for a day. Teach a man to fish and you feed him for a lifetime.
    Chinese Proverb

http://stackoverflow.com/a/195019/804495
https://www.owasp.org/index.php/Category:OWASP_Guide_Project
https://www.owasp.org/index.php/Data_Validation

If you think I'm a bit rude, sorry but that is the point - to show that you need to rethink what you are doing. I would be happy to properly disclose your security vulnerabilities if you didn't choose to make a site handling money (without a clue of what you're doing) as one of your first projects.

People who try to do this need to be discouraged. We don't want another bitcoinica or instawallet.

Also helpful reading: https://bitcointalk.org/index.php?topic=124441.120

[WiseOldOwl]

Make it provably fair.

Stop asking people to do this, if they felt it was in their blueprint or plans it would be included.
It just annoying now. Just dont play if you dont think he is fair. Additionally, He may not even know what that is. You could say something like, "It would be easier to garner trust in this specific community (which is small and insignificant in gambling terms) by providing a service to prove the fairness of your bets...just a suggestion" You make it sound like it is a requirement or something even though like no gambling site ever has ever brought that up or offered such a service to its patrons.
Shut up about provably fair for gods sakes
it will reveal itself through analytics if you really care so much.

[🏰 TradeFortress 🏰]

Stop asking people to do this, if they felt it was in their blueprint or plans it would be included.

I'm expressing my feedback which is "make it provably fair". Given how a new bitcoin casino (without provably fairness and usually also without a clue on how to not get trapped w/ doublespending) pops up at the rate of 2 per day, I really cannot be bothered to "It would be easier to garner trust in this specific community (which is small and insignificant in gambling terms) by providing a service to prove the fairness of your bets...just a suggestion"

The issue is it is very hard to tell if a coin flip site actually has 50/50 chances, or 49/51 chances, or 45/55 chances. When there's something that allows everyone to verify their odds and RNG are fair, then there's no reason to not do it short of the development time. I don't think most people realize that you are handling other people's money.

[Suushi]

@BRules - I'm sorry if that sentence is not grammatically correct, my first language is not English. Also what it means is since I'm using your IP address as a point where to stand and track everything it's possible that somebody might have access to your PC or network and use your IP as a proxy.. So they pretty much can come and steal your bitcoins. This is why I added that message.

@TradeFortress - Explain me, what "fair" means This game is simple and everything works pretty much like this:

Code:

$rand = rand(0, 1)

if($rand == 1)
{
// You will win
}
else
{
// You will lose
}

It's super simple.

@WiseOldOwl  - Thank you for your input

[🏰 TradeFortress 🏰]

First of all, you are using rand. That is not cryptographically secure.

Caution

This function does not generate cryptographically secure values, and should not be used for cryptographic purposes. If you need a cryptographically secure value, consider using openssl_random_pseudo_bytes() instead.

secondly, read this: https://bitcointalk.org/index.php?topic=161236.0

You can't prove to me that your odds are 50/50. Provably fair lets you prove it and let anyone else verify it.

[Suushi]

Are you suggesting that it's possible to hack rand function?

Also there's nothing cryptographic about this system it's just a random choice between 0 or 1

[🏰 TradeFortress 🏰]

1. Yes, I can tell what the result will be if I play enough times. This is the problem of a PRNG, they go 123 -> 342 -> 492 -> 123 -> 342 except on a much larger scale.

Please learn this before handling other people's money.

2. Make it provably fair.

[Suushi]

Hmm okay, I'll make a little test. Tell me how many times number 1 will occur when random number is generated 100k times.

[🏰 TradeFortress 🏰]

Srsly, it's as simple as this:

$secret = "foobar";

function flipCoin($txid){
   return substr(decbin(ord(hash("sha256", $txid . $secret))), 0, 1);
}

echo flipCoin("ebd4d32e72ce9cf4cff1f0baeb1df6243f65f2e16300b839ab96d3f64ad22ba1");

[🏰 TradeFortress 🏰]

Hmm okay, I'll make a little test. Tell me how many times number 1 will occur when random number is generated 100k times.

LOL

I need a series of RNG outputs.

Please read: http://en.wikipedia.org/wiki/Pseudorandom_number_generator
http://www.random.org/randomness/
https://bitcointalk.org/index.php?topic=161236.0

You're not making a flash game here, you are handling people's money.

[Suushi]

But why don't you answer if you know the answer?

Yes, rand is not 100% accurate, but I made a little video as well showing how accurate rand is:

http://screencast.com/t/A2kt5VOb

* edit *

Also you might notice that there is a little "luck" element in rand because gambling basically bases on your luck as well

[🏰 TradeFortress 🏰]

But why don't you answer if you know the answer?

Yes, rand is not 100% accurate, but I made a little video as well showing how accurate rand is:

http://screencast.com/t/A2kt5VOb

I'm not sure if you legitimately have no clue or are just trolling.

Bad PRNGs allows an attacker to predict the next outputs if they have collected enough outputs. Your randomness distribution does not matter, a bad PRNG like rand should not be used for gambling or cryptography even if it has a good distribution.

Also, it took me literally 2 minutes to hack your website and give myself a balance without depositing anything:

[Suushi]

This is nice, thank you for that test. That was what I was looking for in the testers.
Don't worry, I'll send your coins back This is how beta testing works.

Also, can you please pm me the way you did it so I could fix it.

--

Also please stop acting so internet gangsta. If you want the best then give advice not brag what you can do. It makes you look stupid not very friendly

[🏰 TradeFortress 🏰]

This is nice, thank you for that test. That was what I was looking for in the testers.
Don't worry, I'll send your coins back This is how beta testing works.

My coins? I haven't deposited anything.

Also please stop acting so internet gangsta. If you want the best then give advice not brag what you can do. It makes you look stupid not very friendly

Please also have a clue of what you are doing before handling people's money. Really, how many times do I need to say this?

Also, how big is your site's bankroll? It seems like you don't have one at all...

[Suushi]

Do you still understand that I'm not doing this game for profit?
And still, you are not very helpful

[🏰 TradeFortress 🏰]

Do you still understand that I'm not doing this game for profit?

That doesn't excuse the fact that you are making a coinflip game with no bankroll. You also will not make any profit (to donate) on 50/50 coinflips. Don't get me wrong, a dice game where the profits are donated to charity is great, but it shouldn't be done as someone's first coding project.

What if someone actually deposits a bitcoin, flips, and wins 2 BTC? How are they going to get paid, because your site has 0 coins to pay out winnings.

[🏰 TradeFortress 🏰]

Here's another vulnerability you should fix (on top of no coins for withdrawals, and the "free btc")

[Suushi]

Yup there is 0 because I'm working on it so I could test it myself as well as other players.
So there won't be any weird situations like you are pointing it out.

I would be happy if you could point me to the right direction so I could fix it faster ?
Also it would be nice if you could test it little bit later when I have applied the fixes.