Do you verify every bet as a gambler? Provably Fair Guide.

[webtricks]

UPDATE (31/08/20): BTCGOSU has launched a biggest third-party provably fair verifier tool where you can verify bets for over 25 casinos in single page. Check out now: https://www.btcgosu.com/tools/provably-fair-verifier/

Provably Fair Script is one of the basic element of online gambling, especially for crypto based casinos. However, most of the gamblers don't give dime about it while some don't even know what is it and how it operates. I started crypto gambling in 2016 and didn't know about Provably Fair for most of my initial gambling days. But believe me in the absence of Provably Fair, you are not gambling, you are just being cheated by the house.

The basic idea of this thread is to share my views on PF script and how to make most out of it. I have spent few weeks developing unique logic for Provably Fair script for upcoming gambling site clubbing it with blockchain technology. While developing it, I visited around 20 casinos and tried their PF script to understand current practice. However, this thread is not about my script but about current practice.

If you are in this section, you probably have heard about Provably Fair script and may be verifying your bets too. But have you ever tried to understand the logic behind it? If not, let me give a brief explanation on how Provably Fair system works.

Different gambling sites use different Provably Fair implementation however the basic idea is to generate a random number based on three factors: client seed, server seed and nonce.

Client seed: It can be anything. It is up to player to choose anything as his client seed. For example, I can use 'webtricksClientSeed' as my client seed or 'thisIsMyRandomClientSeed'. However, while choosing client seed make sure three things:
(i) Always choose new seed for new bet (never try same client seed with new server seed).
(ii) Don't choose easily identifiable seeds like I mentioned above (close your eyes and type random numbers and alphabets. I do like this and it works ).
(iii) Site will generate random client seed for you but don't use it. Always choose your own.

Server Seed: It is generated by server. Server will choose random string of random length and convert it to sha256 hash which will provided to you. For example, if server picks 'thisIsRandomSeed' as server seed then this will be provide you: 45006cccc7e44ee0b6c0752469de2fe1ad6bff589fb789bfb60773224cf2cc0a.
Since sha256 is one-way hashing you will know sha256 hash before making bet but you cannot decipher server seed before betting. The site will show you unhashed server seed once you change your seeds. Then you can verify that the sha256 hash of server seed is similar to what was presented to you before bet.

Nonce: In context of Provably Fair, nonce is mostly regarded as the number of times you have made bet with the combination of same client and server seed. For example, if I make two bets with 'ClientSeed' as client seed and 'ServerSeed' as server seed then the result of bet will be generated on the basis of 'ClientSeed+1+ServerSeed' for first bet and 'ClientSeed+2+ServerSeed' for second bet.

Here is graphical illustration of what I just said:

(Some people say my drawings are as good as Picasso's.)

Now coming to how results are driven from these seeds. As I said earlier, different sites use different logic to determine result. However, there is one basic logic which is being used by around 80% of the casinos, notably Fortunejack, PrimeDice, Bitsler etc. This is how it works:

Step 1: First of all let's assume three variables. Server seed = 'ServerSeed', client seed = 'ClientSeed' and nonce = 1. Now we have to use hmac authentication by hashing our variables using sha512 hashing algorithm. Server seed will serve as a secret key to generate hash while client seed and nonce will be used as an input like this: 'ClientSeed-1' or 'client seed - nonce'.

Step 2: So the hash of the above seeds will look like this: 671e7387e26fa724d089521805430866b29f6849ad2928a26e5ed01101f72f57883b972f20f9464 d99ab13c2adcf37bd955863c69697739628d70969adba1ab3

Step 3: Not going into technical term and by simply sticking to layman's language, we have to take first 5 characters of hash i.e. 671e7. Now we have to convert these 5 characters from hex value to integer value which will be: 422375.

Step 4: If the integer value is between 0 and 1million (1,000,000) then it's ok. But if it is more than or equal to 1M then we will use next 5 characters from hash. But since in our case, 422375 is less than 1000000 so this number will determine the result.

Step 5: In this step, we will simply divide the value with 10000 and take the remainder for next step. In our case, 422375 when divided by 10000 will leave 2375 in remainder which will be consider for final step.

Step 6: In this step, we will simply divide the remainder by 100 and this will determine the final result. In our case it will be 23.75. This should match the dice roll. If not then site is most probably cheating you.


Now coming to the most important part. Probably this part is the main reason why I created this thread. Although, the above system is foolproof but site owners can easily fool you if you ain't paying enough attention. So here are the few points you should consider while gambling:

(i) Always copy server seed hash shown to you before betting.
(ii) After bet is complete, create new client seed. Make sure server seed is also changed along with it.
(iii) Once new client seed is created, site will show you unhashed server seed of previous bet. Copy it and convert it to sha256 hash using some third party online tool.
(iv) Match the server seed hash that you copied in step (i) to the one generated in step (iii) and make sure both are exactly same.

Two days ago, I tested my code with few people. I shown them different server seed hash before bet and after bet I kept first 6 characters same, last 3 characters same and few similar characters in the middle. It took just 30-40 seconds for my machine to generate such hash. With more powerful machine, I can speed up the process and create more matching characters. To my surprise, none of the tester noticed that they were shown different server hash before and after bet. It is human tendency that they only consider few letters (probably starting and ending ones) when presented random word like hexadecimal hash. So with bare eyes, no one was able to notice the difference. So be safe and make sure you verify every bet you make. Being a coding enthusiast, I can assure you that it is very much possible that house can easily manipulate results without player even noticing.

Another thing you can do is to use cross-casinos verification. For example, Fortunejack and Bitsler use same script, you can verify your fortunejack bets using bitsler's verification script.

[1714464680]

1714464680

[1714464680]

1714464680

[1714464680]

1714464680

[1714464680]

1714464680

[1714464680]

1714464680

[1714464680]

1714464680

[Twentyonepaylots]

Provably Fair Script is one of the basic element of online gambling, especially for crypto based casinos. However, most of the gamblers don't give dime about it while some don't even know what is it and how it operates. I started crypto gambling in 2016 and didn't know about Provably Fair for most of my initial gambling days. But believe me in the absence of Provably Fair, you are not gambling, you are just being cheated by the house.

The basic idea of this thread is to share my views on PF script and how to make most out of it. I have spent few weeks developing unique logic for Provably Fair script for upcoming gambling site clubbing it with blockchain technology. While developing it, I visited around 20 casinos and tried their PF script to understand current practice. However, this thread is not about my script but about current practice.

If you are in this section, you probably have heard about Provably Fair script and may be verifying your bets too. But have you ever tried to understand the logic behind it? If not, let me give a brief explanation on how Provably Fair system works.

Different gambling sites use different Provably Fair implementation however the basic idea is to generate a random number based on three factors: client seed, server seed and nonce.

Client seed: It can be anything. It is up to player to choose anything as his client seed. For example, I can use 'webtricksClientSeed' as my client seed or 'thisIsMyRandomClientSeed'. However, while choosing client seed make sure three things:
(i) Always choose new seed for new bet (never try same client seed with new server seed).
(ii) Don't choose easily identifiable seeds like I mentioned above (close your eyes and type random numbers and alphabets. I do like this and it works ).
(iii) Site will generate random client seed for you but don't use it. Always choose your own.

Server Seed: It is generated by server. Server will choose random string of random length and convert it to sha256 hash which will provided to you. For example, if server picks 'thisIsRandomSeed' as server seed then this will be provide you: 45006cccc7e44ee0b6c0752469de2fe1ad6bff589fb789bfb60773224cf2cc0a.
Since sha256 is one-way hashing you will know sha256 hash before making bet but you cannot decipher server seed before betting. The site will show you unhashed server seed once you change your seeds. Then you can verify that the sha256 hash of server seed is similar to what was presented to you before bet.

Nonce: In context of Provably Fair, nonce is mostly regarded as the number of times you have made bet with the combination of same client and server seed. For example, if I make two bets with 'ClientSeed' as client seed and 'ServerSeed' as server seed then the result of bet will be generated on the basis of 'ClientSeed+1+ServerSeed' for first bet and 'ClientSeed+2+ServerSeed' for second bet.

Here is graphical illustration of what I just said:

(Some people say my drawings are as good as Picasso's.)

Now coming to how results are driven from these seeds. As I said earlier, different sites use different logic to determine result. However, there is one basic logic which is being used by around 80% of the casinos, notably Fortunejack, PrimeDice, Bitsler etc. This is how it works:

Step 1: First of all let's assume three variables. Server seed = 'ServerSeed', client seed = 'ClientSeed' and nonce = 1. Now we have to use hmac authentication by hashing our variables using sha512 hashing algorithm. Server seed will serve as a secret key to generate hash while client seed and nonce will be used as an input like this: 'ClientSeed-1' or 'client seed - nonce'.

Step 2: So the hash of the above seeds will look like this: 671e7387e26fa724d089521805430866b29f6849ad2928a26e5ed01101f72f57883b972f20f9464 d99ab13c2adcf37bd955863c69697739628d70969adba1ab3

Step 3: Not going into technical term and by simply sticking to layman's language, we have to take first 5 characters of hash i.e. 671e7. Now we have to convert these 5 characters from hex value to integer value which will be: 422375.

Step 4: If the integer value is between 0 and 1million (1,000,000) then it's ok. But if it is more than or equal to 1M then we will use next 5 characters from hash. But since in our case, 422375 is less than 1000000 so this number will determine the result.

Step 5: In this step, we will simply divide the value with 10000 and take the remainder for next step. In our case, 422375 when divided by 10000 will leave 2375 in remainder which will be consider for final step.

Step 6: In this step, we will simply divide the remainder by 100 and this will determine the final result. In our case it will be 23.75. This should match the dice roll. If not then site is most probably cheating you.


Now coming to the most important part. Probably this part is the main reason why I created this thread. Although, the above system is foolproof but site owners can easily fool you if you ain't paying enough attention. So here are the few points you should consider while gambling:

(i) Always copy server seed hash shown to you before betting.
(ii) After bet is complete, create new client seed. Make sure server seed is also changed along with it.
(iii) Once new client seed is created, site will show you unhashed server seed of previous bet. Copy it and convert it to sha256 hash using some third party online tool.
(iv) Match the server seed hash that you copied in step (i) to the one generated in step (iii) and make sure both are exactly same.

Two days ago, I tested my code with few people. I shown them different server seed hash before bet and after bet I kept first 6 characters same, last 3 characters same and few similar characters in the middle. It took just 30-40 seconds for my machine to generate such hash. With more powerful machine, I can speed up the process and create more matching characters. To my surprise, none of the tester noticed that they were shown different server hash before and after bet. It is human tendency that they only consider few letters (probably starting and ending ones) when presented random word like hexadecimal hash. So with bare eyes, no one was able to notice the difference. So be safe and make sure you verify every bet you make. Being a coding enthusiast, I can assure you that it is very much possible that house can easily manipulate results without player even noticing.

Another thing you can do is to use cross-casinos verification. For example, Fortunejack and Bitsler use same script, you can verify your fortunejack bets using bitsler's verification script.

I have been playing in an online betting website for the past couple of weeks but still have not won even a single time. It made me suspect that the site is rigged and that unless their bots say so, we wouldn't be able to get profits from them. I'll try to use your procedures just to confirm my claim as if it is true then they are fooling hundreds of thousands of gamblers rihht now to a game we virtually have no way or chance at winning. So I thank you for this. Help like these should be much readily available in this channel as gambling is the riskiest thing you could do with bitcoin.

[webtricks]

~~

I have been playing in an online betting website for the past couple of weeks but still have not won even a single time. It made me suspect that the site is rigged and that unless their bots say so, we wouldn't be able to get profits from them. I'll try to use your procedures just to confirm my claim as if it is true then they are fooling hundreds of thousands of gamblers rihht now to a game we virtually have no way or chance at winning. So I thank you for this. Help like these should be much readily available in this channel as gambling is the riskiest thing you could do with bitcoin.

Your experience surely sounding fishy. I would recommend you to check the fairness of site.

I have discovered another way a gambling site can scam players. Under this, a site has a special code which sets the checkbox false if player has less than say, 100 bets. But as soon as player plays more than that, code checks if player has ever changed his client seed or not. If no, this means player never checked the fairness of game and doesn't care about provably fair at all. In that case, code changes the status of checkbox to true. Then provably fair code checks if checkbox is true/false. If true then fake seed hash is shown to player and game is rigged.

[iamsheikhadil]

Thanks for sharing this. I wouldn't name a site where I have played in past in like 2016 where I was losing 50s of bets in a row at 50% win chance and after a few days I came to know how the site was changing the client seed itself and how I was being manipulated and I didn't play there anymore. Truly, anything can be done these days!

[dunfida]

~snip~

A helpful guide.

Pretty sure that 80%-90% of gamblers or people here doesnt even know on how Provably fair works.
So this post is a good read up for people to know on how to check the fairness of a certain site.
People just tend to stick out with known or popular ones and treat it up to be fair along the way. 

[nakamura12]

Thanks for sharing this. I wouldn't name a site where I have played in past in like 2016 where I was losing 50s of bets in a row at 50% win chance and after a few days I came to know how the site was changing the client seed itself and how I was being manipulated and I didn't play there anymore. Truly, anything can be done these days!

That is why gamblers should always check the site's fairness if it really what the site claim. Mostly, the legit gambling sites is not rigged and it's completely random that is why it is gambling. If it is not random and my opinion about it is that it's not a gambling site but a scam scheme. If it is rigged the things that will happen to gamblers is mostly lose and seldomly wins.

[jademaxsuy]

~snip~

A helpful guide.

Pretty sure that 80%-90% of gamblers or people here doesnt even know on how Provably fair works.
So this post is a good read up for people to know on how to check the fairness of a certain site.
People just tend to stick out with known or popular ones and treat it up to be fair along the way. 

It's true that most gamblers didn't know how provably fair works. It is very important that gamblers should know how to check the fairness of the game. This thread will help gamblers know how to verify if the game is really provable fair or rigged. Knowing how to verify is very useful so that gamblers will know what site to stay away.

[khaled0111]

I always copy the hash of the server seed and provide my custom client seed to avoid any manipulation. However,I don't check all the results, only when I have doubts using third party tools (if you don't trust the casino then you should not trust their verification scrypt).

[Lakai01]

(if you don't trust the casino then you should not trust their verification scrypt).

That is the most important part in my opinion. If you use a sites own script to verify the fairness of the site itself you just waste your time. The script wont prove the site as "unfair" in any circumstances

[skarais]

~~~

I hope your experiences and observations over the past few weeks can open your eyes to anyone who gamblers. So far not many people realize that the site can be manipulated and unfair to players and your explanation really helps them find out more about PF scripts on gambling sites. I will immediately practice what you have just explained about PF and it is true that without PF we are not said to gamble but we are cheated.

[imstillthebest]

thanks for the effort of putting this up  but may i know if what site is it that gives incorrect verification  . thats shady then , but do you already reported them  ?  this is bad if its happening on reputable casinos because this can damage thier reputation  but by the way  , your given points above are correct  . about changing client seed  , many gamblers believe on it that changing it will give miracles but for me i dont believe on it  . i never change my seed but i still feel that the results are the same  . i dont verify my bets because i dont have a doubt on a gambling site that im playing with  but i check it once though and the result match  .

[swogerino]

This is a great topic and you have done an excellent job in breaking it down for even non tech users to easily understand the concept.I think the users now as you say should be more careful and they should report to the forum more specifically to this thread what they think as anomalies found on their gambling website or platform.
Sure this will help a lot in this regard.

[leea-1334]

Thank you for the thread. To be honest I am not 100% sure of how to check for provably fair on every site I own some money at but the one I play the most I do check, and you are right, I think most of us actually do not always regularly check but we should. We owe it to ourselves and the community,,, especially when we get losing bets;) or rare results. Hard to check everything on autobet, maybe there should be a system to do it easily.

[tbterryboy]

I'm not believing in to probably fair system because in real life there are less possibility for continue losing streak but in almost all the to gambling houses continue losing streaks are happening most commonly. This makes we need much more improvements/developments to fine-tune so that those provably fair mechanism will be actually fair for all of us.

Honestly I'm not familiar with SHA algorithms and hashing or unhashing things which makes me unable to verify my betting.
I believe gambling houses must work on simplifying these things so that even non-computer literature people also will be able to verify them with just one click.

[seoincorporation]

If we understand the math and crypto behind the provably fair engine, then we can trust the casino. If something doesn't look fine, then we show stay away from it.

The last provably fair engine i read about was the one of Luckybit. They use a client seed, server seed, and a seed_nonce... Since we have control of the 3 factors, then we can trust their engine.

[khaled0111]

Honestly I'm not familiar with SHA algorithms and hashing or unhashing things which makes me unable to verify my betting.

OP gave an example on how to verify the results you got. It doesn't require a lot of knowledge and you are not going to do anything manually. Just use a third party website to give you the seeds hash or use the verification scrypt of another casino that has the same provably fair algorithm.

[Twinkledoe]

Honestly I'm not familiar with SHA algorithms and hashing or unhashing things which makes me unable to verify my betting.

OP gave an example on how to verify the results you got. It doesn't require a lot of knowledge and you are not going to do anything manually. Just use a third party website to give you the seeds hash or use the verification scrypt of another casino that has the same provably fair algorithm.

Or most of the legit casino sites has basic tutorial on how to verify their provably fair system. And if you are still in doubt, you can double check the procedure with other popular gambling sites because verifying your results has basically straightforward steps and almost the same with every casino. Though I am not really checking every bet of mine, but if I have bet larger than my normal bet, I see to it that I checked its provable fairness afterwards. Just a random check would make you feel that you are safe with your casino site.

[serjent05]

Great works on defining how Provably Fair works.  As a player who uses auto roll function, I seldom check the hashes of both client, server seed and its nonce.  All that goes in me is trust in the site I am playing with.   And if ever I got a doubt on the result,( with the thousands of bets done on an auto roll, it will be a waste of time verifying the hashes of each roll,) so I just pick a random hash and verify it and done.

[milewilda]

Honestly I'm not familiar with SHA algorithms and hashing or unhashing things which makes me unable to verify my betting.

OP gave an example on how to verify the results you got. It doesn't require a lot of knowledge and you are not going to do anything manually. Just use a third party website to give you the seeds hash or use the verification scrypt of another casino that has the same provably fair algorithm.

Or most of the legit casino sites has basic tutorial on how to verify their provably fair system. And if you are still in doubt, you can double check the procedure with other popular gambling sites because verifying your results has basically straightforward steps and almost the same with every casino. Though I am not really checking every bet of mine, but if I have bet larger than my normal bet, I see to it that I checked its provable fairness afterwards. Just a random check would make you feel that you are safe with your casino site.

Example: https://www.youtube.com/watch?v=Qf6ZxDXvU7o
Im not affiliated with the site but just for the purpose on showing off on screen on how to verify bets.It doesnt really require technical knowledge though yet following on how
to verify bets isnt really that hard.
Some people or players are really keen on checking out provably fairness but on my side, i do play on site which had been played out by the majority.

[michellee]

I am not sure if I can check or verify the gambling site from the OP guide as I am only playing gambling on a random day, and I don't need to check to details. I don't know much about the provable system, but that is a good guide that will be useful for someone who wants to verify by themselves. However, I think the provable system itself is fair for every member, and I don't think that the reputable gambling site will cheat their members because that will have a bad effect on the website itself.