If I wanted to start a Bitcoin casino... [will pay for help]

[mc_lovin]

So basically I have the site Bitcoin Mafia.

I want to make it so that people can have a Bitcoin balance displayed on the site alongside the Mafia Cash so that people can purchase lottery tickets using bitcoin for a bitcoin lottery plus go to the casino and play actual bitcoin roulette to win/lose bitcoin. 

I could probably implement this in a simple way but I don't know how to secure the code and make it so that it's safe for everyone.

Sites like bittleships and luckycoin casino make it look so easy to deposit/spend/earn/withdrawl bitcoin, and I was wondering if someone would help me set that up.

I have other ideas for uses of Bitcoin in the game, but I'll leave it at that for now and see what you guys think.

[1714195253]

1714195253

[1714195253]

1714195253

[MORA]

Will your casino be security validated by a approved 3rd party ?

Its fairly easy to fire up a few games, but just like when secondlife was young, without validation, the users dont know how fair the games really are.

ie. its pretty easy to detect a user using double bet attack, and let them succeed a few times, before locking them in for a 50x lost bet.

In the real world slot machines are required to display their current payout pct, and it needs to be above xx%, but still if noone verifies the machine/script, you could print 99% payout pct and in fact payout less than that.

If users cannot trust that they are being treated as fairly as any other real life casino, I dont see it taking off bigtime.

[mc_lovin]

Will your casino be security validated by a approved 3rd party ?

Its fairly easy to fire up a few games, but just like when secondlife was young, without validation, the users dont know how fair the games really are.

ie. its pretty easy to detect a user using double bet attack, and let them succeed a few times, before locking them in for a 50x lost bet.

In the real world slot machines are required to display their current payout pct, and it needs to be above xx%, but still if noone verifies the machine/script, you could print 99% payout pct and in fact payout less than that.

If users cannot trust that they are being treated as fairly as any other real life casino, I dont see it taking off bigtime.

Absolutely.  If there is a way to have a 3rd party approve it that would be the most legit way to do things.   I want to do this right.

[Vernon715]

I would recommend reading about how physical casinos prove that they are fair.

[1QaZxSw2]

Trusting online casinos is very very hard. The temptation to "adjust the rules" to benefit the casino is too high.

For example, in a physical casino a 6 deck blackjack is shuffled when the stack is about 2/3 or 3/4 exhausted. Online casinos typically shuffle the cards after every deal. This reduces player edge and prevents counting for example.

Online slot machines are far worse. They can easily payout only on small bets or adjust the payout rate by the hour.

If you want to prove that your casino is on the up-and-up, you may have to do the following:

In realtime, show every btc going into the system and going out for each slot, BJ or other game. Sort of like a time and sales display on a trading platform. So for example, if I bet 1 BTC on a BJ hand, it prints the entry right away. When its paid out, it prints that right away as well.

BJ   Table3   1QaZxSw2    1BTC      bet
BJ   Table3   1QaZxSw2    1.5BTC   win

Player's eyes will monitor the tables they are in and over time, sufficient trust should develop. Casinos typically can afford to be honest, since games are designed to benefit the casino in the long run. All players will lose in the long run but sufficient number have to win occasionally to keep the game attractive.

You can also publish your algorithms and source code and have their md5 hash published. Independent auditors can analyze your code to make sure its fair, etc.

[arsenische]

I think much depends on the game.

If it is a roulette - you could show the hash of the salted outcome before players make bets and show the sault after the game ends.

Many games could be secured this way (use pregenerated random values show the hashes of game states before players make decisions).

However if players play against each other and they have something to hide from each other (like in poker) then it is harder (since casino owner potentially knows the cards of other players and it gives him/her possibility to play against them).

[grue]

card based games: the card order is hashed prior to a game, and the hash is presented to the user
dice/roulette: hash of the outcome is presented to the user prior to the game
the data in each of the cases probably will have to be padded with some random data to prevent someone from bruteforcing the results to gain an advantage.

ie. its pretty easy to detect a user using double bet attack, and let them succeed a few times, before locking them in for a 50x lost bet.

Don't even need to try, https://en.wikipedia.org/wiki/Martingale_%28betting_system%29

In the real world slot machines are required to display their current payout pct, and it needs to be above xx%, but still if noone verifies the machine/script, you could print 99% payout pct and in fact payout less than that.

If users cannot trust that they are being treated as fairly as any other real life casino, I dont see it taking off bigtime.

After some thinking, I came up with this. It should be cheat-proof from both parties, and is fully auditable.

Every day, generate a table with n + 1 columns (n being the number of "wheels" in the slot machine), and a very large number of rows. Now fill all of it with random numbers. Those random numbers will represent the outcome of a slot machine play. For example, column 1 will represent the position of where the first "wheel" will land, the second will represent the second "wheel", etc.. Now, hash each row's data + some random padding, and save the hash in the last column. Now publish the table, with only the last column. When a user plays, he/she will be allowed to choose from any hash he/she wants. After 36 hours, publish the entire table. Now anyone can audit the table to ensure that the game is indeed fair, and since another table has been generated for the day, no one can cheat. The casino can't cheat in this case because the hash has already been published prior to play, so there's a very low chance the results has been tampered with.

[arsenische]

card based games: the card order is hashed prior to a game, and the hash is presented to the user
...
Now anyone can audit the table to ensure that the game is indeed fair, and since another table has been generated for the day, no one can cheat.

that's what I meant ("use pregenerated random values show the hashes of game states before players make decision"), but it won't probably work well for many card games, because:

if players play against each other and they have something to hide from each other (like in poker) then it is harder (since casino owner potentially knows the cards of other players and it gives him/her possibility to play against them).

Or am I misunderstanding something?

[1QaZxSw2]

card based games: the card order is hashed prior to a game, and the hash is presented to the user
...
Now anyone can audit the table to ensure that the game is indeed fair, and since another table has been generated for the day, no one can cheat.

that's what I meant ("use pregenerated random values show the hashes of game states before players make decision"), but it won't probably work well for many card games, because:

if players play against each other and they have something to hide from each other (like in poker) then it is harder (since casino owner potentially knows the cards of other players and it gives him/her possibility to play against them).

Or am I misunderstanding something?

No, you understand correctly. The risk of a casino creating a bot that will play blackjack to soak all the good cards is possible.

For example: deck is pregenerated. The likely outcome of every hand for every player is already known (since most players will follow basic strategy). If the casino detects that one of the players is likely to get a blackjack, the casino can simply put a bot player on the table to soak up the face cards and change the outcome. This may be negated by having one player per table (easy to do online). However, there is no guarantee that all decks would be casino favorable even with published hashes. The only way around this is to allow a player to cut the deck. The cut deck + hash should be fairly acceptable. In any case, blackjack online is not very house-friendly since the players can easily note down every card and use all kinds of counting software for them. The only way a house will have an advantage is to reshuffle the deck after every hand.

Poker on the other hand is very very hard. Even if you can get a secure deck, the casino does know what cards any player is holding and it would give casino bots a huge advantage.

As others have said here, all other games can be worked out by publishing the hash first before every roll.

[MORA]

ie. its pretty easy to detect a user using double bet attack, and let them succeed a few times, before locking them in for a 50x lost bet.

Don't even need to try, https://en.wikipedia.org/wiki/Martingale_%28betting_system%29

Yes that system was what I meant, what do you mean with "dont even need to try" ?

The published hash idea is pretty neat, would work well for most games, as long as the hash is complex enough.
(0xAA 0xAA 0xAA) would be pretty obvious for a 3 wheel spin thing.

[dooglus]

Don't even need to try, https://en.wikipedia.org/wiki/Martingale_%28betting_system%29

Yes that system was what I meant, what do you mean with "dont even need to try" ?

He meant this part of that page:

The conclusion is that players using Martingale strategy pose no threat to a casino. The odds are high that the player will go bust before he is able even to double his money.

[Retard]

If you create a Casino you need enough Money for the Casino Pot.

For example my site have instant Payout and the Wallet must be everytime full with enough coins.

And for the fairness you can use mt_rand for every game round.

[MORA]

The conclusion is that players using Martingale strategy pose no threat to a casino. The odds are high that the player will go bust before he is able even to double his money.

Well that depends on minimum bet, maximum bet and wallet size

Say minimum 0.01BTC max 1000BTC wallet ~1300BTC

0.01
0.02
0.04
0.08
0.16
0.32
0.64
1.28
2.56
5.12
10.24
20.48
40.96
81.92
163.84
327.68
655.36
BUST

Thats 17misses in a row, absolutely possible, however fairly unlikely.
The casino can limit the betting range, but the bot could just jump tables.
And since its a bot, even 0.01BTC per win will be fine, if it can just do 1 win per 5minutes thats 2.88BTC per day per bot/played table, they can even share money pool if the deposit system accepts a low amount of verifications, or you could have bots continuously sitting at different tables, so when the 0.01bot looses a 0.64bet, the next bot takes over at a higher stake table and the first bot starts over on a new round, that way you dont need to move the big cash around.

Ofcause this is not practical, since the risk is alot higher than the gain, a 1000BTC risk for maybe 10BTC/day, you might as well play it all on red and wall away

[GamblingPurveyor]

Sites like bittleships and luckycoin casino make it look so easy to deposit/spend/earn/withdrawl bitcoin, and I was wondering if someone would help me set that up.

It's pretty easy to do if you run your own bitcoind. You use the bitcoind JSON RPC to detect player deposits, and all other transactions are just INSERTs into your database. Then, a SQL query like this can give you the player's balance:

Code:

   SELECT SUM(AMOUNT) FROM TXNS WHERE UID=[user's id];

Combine this with client-side polling, and voila!

[1QaZxSw2]

Sites like bittleships and luckycoin casino make it look so easy to deposit/spend/earn/withdrawl bitcoin, and I was wondering if someone would help me set that up.

It's pretty easy to do if you run your own bitcoind. You use the bitcoind JSON RPC to detect player deposits, and all other transactions are just INSERTs into your database. Then, a SQL query like this can give you the player's balance:

Code:

   SELECT SUM(AMOUNT) FROM TXNS WHERE UID=[user's id];

Combine this with client-side polling, and voila!

SUM(AMOUNT) will quickly slow down your site if you plan to have millions of users. A simpler strategy is to do a small incremental computation with each transaction and record the new total balance with each transaction. That way you just need a simple SELECT to get the balance.

[ssaCEO]

Sites like bittleships and luckycoin casino make it look so easy to deposit/spend/earn/withdrawl bitcoin, and I was wondering if someone would help me set that up.

It's pretty easy to do if you run your own bitcoind. You use the bitcoind JSON RPC to detect player deposits, and all other transactions are just INSERTs into your database. Then, a SQL query like this can give you the player's balance:

Code:

   SELECT SUM(AMOUNT) FROM TXNS WHERE UID=[user's id];

Combine this with client-side polling, and voila!

SUM(AMOUNT) will quickly slow down your site if you plan to have millions of users. A simpler strategy is to do a small incremental computation with each transaction and record the new total balance with each transaction. That way you just need a simple SELECT to get the balance.

Keeping running balances without checking them frequently against sums is not safe when building a site that deals with real money. What if your application or your database goes down in the middle of an update? Moreover, timestamps can and do change on bitcoin transactions after they've shown up in a wallet. You can't just look at the last timestamp and take all the transactions that happened in it, or you'll end up polling the same transactions twice and adding them to the user's running database sum. So for data consistency you'd then need to compare the TXID against all TXIDs you've processed before, which is a much slower operation than a simple SUM of the user's transactions compared to that user's wallet account balance.

We use (basically) the SUM(AMOUNT) strategy. If you're worried about speed when you have a million users, partition your transactional database by user IDs, or shard it over multiple instances. If you're running bitcoind, you should be running it on a separate dedicated machine anyway, and it's doubtful you'll have a very efficient system if you're running one instance with a million wallets anyway. So have a db over there on each bitcoind machine that does the summing for a particular group of users (100k would probably be an upward reasonable limit), and then opens a socket to send the results to your game server. SUM() on a primary key is plenty fast over millions of rows even without partitioning.

Also bear in mind that if you ever find yourself running a successful Bitcoin casino with millions of users, you will probably have plenty of spare cash for server upgrades. Writing NoSQL or non-ACID code that trusts your application layer to never miss or repeat a single real-money transaction will create its own scaling problems and is very, very unsafe.

[Ab37]

I saw this thread and thought "Would an actual physical bitcoin casino be legal?"
If not could i create a bitcoin exchange\internet cafe where the users would bid with there bit coins online at there choice of website (Maybe the house could run one). Then when they are done send there hard earned btc to their special btc address registered with there "Username". Am i wrong could you legally gamble with bitcoins?

[Elwar]

The conclusion is that players using Martingale strategy pose no threat to a casino. The odds are high that the player will go bust before he is able even to double his money.

Well that depends on minimum bet, maximum bet and wallet size

Say minimum 0.01BTC max 1000BTC wallet ~1300BTC

0.01
0.02
0.04
0.08
0.16
0.32
0.64
1.28
2.56
5.12
10.24
20.48
40.96
81.92
163.84
327.68
655.36
BUST

Thats 17misses in a row, absolutely possible, however fairly unlikely.
The casino can limit the betting range, but the bot could just jump tables.
And since its a bot, even 0.01BTC per win will be fine, if it can just do 1 win per 5minutes thats 2.88BTC per day per bot/played table, they can even share money pool if the deposit system accepts a low amount of verifications, or you could have bots continuously sitting at different tables, so when the 0.01bot looses a 0.64bet, the next bot takes over at a higher stake table and the first bot starts over on a new round, that way you dont need to move the big cash around.

Ofcause this is not practical, since the risk is alot higher than the gain, a 1000BTC risk for maybe 10BTC/day, you might as well play it all on red and wall away

I wrote a computer program to run through a game of roulette over and over using the doubling method starting with a million bucks on a $5 minimum. It would go up for a while then BAM...hit a huge losing streak and lose it all.

I think of it like an opposite lottery. Take $175 million and bet on a number. If the number does not hit, then you win a dollar. If it hits, you lose it all. Sure, odds are that you will probably win that dollar, and win it many times. But there is always that chance that the number hits and you lose it all. And at the casino, the odds are in favor in the house.

[PawShaker]

There is a method to play cards on internet and be fair and secure. However, I expect a generous tip, do you agree? If you agree then read on  

1. There are N players at the table.
2. Each player generates his own encryption and decryption keys for commutative chipper. Both are secret. (More about such chippers later.)
3. A salt is selected and published.
4. Player 1 creates a deck. Each card consists of plain text: card,siut,salt
5. Each player, including player 1, encrypts each card with his own encryption key, shuffle the whole deck, and then passes the deck to a next player.
6. When the deck has been encrypted and shuffled by everyone, anyone can be a dealer. It can be player N, or 1, or random one.
7. When dealer wants to give a card to player K, he first passes this card to Player K+1 for decryption. (Of course if card is for player N then start with player 1.) Each player, starting with K+1, decrypts the card and passes it to next one (player 1 is next after player N). In this way Player K gets the card last. When decrypted by player K, the card will read: card,siut,salt. If message is readable (salt does match) then no tampering has occured.

Since player K is the last to decrypt the card, he can be sure no one else knows what card he was delt! You can play any kind of card game in this way. How cool is that?

Now about commutative chipper as prommised in step 2. This is a chipper where E(key1, E(key2, message)) = E(key2, E(key1, message)). This means that you can decrypt in any order.

You can use a variation of RSA encryption to achieve this. In this variation both encryption and decryption keys are SECRET. However, the parameters necessary to generate them are public. In particular two prime numbers are disclosed.

So we publicly generate two large prime numbers p and q, then calculate n=p*q and PHI=(p-1)*(q-1).

Next each player in secret picks up his own encryption key e which is relatively prime to PHI. If N is large that is trivial with ony few trials and errors.

Each player, also in secret, calculates decryption key d=e^(-1) mod PHI.

Encryption is calculated as c = m^e mod n (where c stands for cypertext and m for message).
Decryption is calculated as m = c^d mod n.

For the sake of this example m = (card-2) + 13 * siut + 52 * salt
card = (m mod 13) + 2
siut = floor(m/13) mod 4
salt = floor(m/52)

My tip wallet is 1FQkH63k6hkexFMTRzLtJEE6ZAaTBRhjiS  

Edit: typo

[teflone]

There is a method to play cards on internet and be fair and secure. However, I expect a generous tip, do you agree? If you agree then read on  

1. There are N players at the table.
2. Each player generates his own encryption and decryption keys for commutative chipper. Both are secret. (More about such chippers later.)
3. A salt is selected and published.
4. Player 1 creates a deck. Each card consists of plain text: card,siut,salt
5. Each player, including player 1, encrypts each card with his own encryption key, shuffle the whole deck, and then passes the deck to a next player.
6. When the deck has been encrypted and shuffled by everyone, anyone can be a dealer. It can be player N, or 1, or random one.
7. When dealer wants to give a card to player K, he first passes this card to Player K+1 for decryption. (Of course if card is for player N then start with player 1.) Each player, starting with K+1, decrypts the card and passes it to next one (player 1 is next after player N). In this way Player K gets the card last. When decrypted by player K, the card will read: card,siut,salt. If message is readable (salt does match) then no tampering has occured.

Since player K is the last to decrypt the card, he can be sure no one else knows what card he was delt! You can play any kind of card game in this way. How cool is that?

Now about commutative chipper as prommised in step 2. This is a chipper where E(key1, E(key2, message)) = E(key2, E(key1, message)). This means that you can decrypt in any order.

You can use a variation of RSA encryption to achieve this. In this variation both encryption and decryption keys are SECRET. However, the parameters necessary to generate them are public. In particular two prime numbers are disclosed.

So we publicly generate two large prime numbers p and q, then calculate n=p*q and PHI=(p-1)*(q-1).

Next each player in secret picks up his own encryption key e which is relatively prime to PHI. If N is large that is trivial with ony few trials and errors.

Each player, also in secret, calculates decryption key d=e^(-1) mod PHI.

Encryption is calculated as c = m^e mod n (where c stands for cypertext and m for message).
Decryption is calculated as m = c^d mod n.

For the sake of this example m = (card-2) + 13 * siut + 52 * salt
card = (m mod 13) + 2
siut = floor(m/13) mod 4
salt = floor(m/52)

My tip wallet is 1FQkH63k6hkexFMTRzLtJEE6ZAaTBRhjiS  

Edit: typo

Whoa... heavy shit..

I like what I read, the little I understand