Provably fair, byte by byte.

A fair coin flip is one where nobody can influence the outcome after bets are placed, and anyone can verify the result after the fact. The challenge in online gambling is that somebody has to generate the randomness — and they can't be trusted to report it honestly unless they've somehow committed to it in advance.

Our scheme is the standard "commit-reveal" construction:

1. Commit: Before you bet, we generate a random server seed, compute its SHA-256 hash, and publish the hash on-chain. This locks in the seed — we cannot change it later without breaking the hash.
2. Bet: You choose what to bet on. Your choice becomes part of a deterministic client seed, which mixes into the outcome.
3. Reveal: After the bet is placed, we submit the raw seed. The program on-chain recomputes the hash and refuses to settle unless it matches what we committed.
4. Verify: The seed is now public. You can take the server seed, your client seed, the nonce, and the same hash function we use, and recompute the outcome yourself.

All three inputs are concatenated with colons and hashed once more. The result is 32 bytes of pseudo-random data that drives the game.

client_seed_hex = Base.encode16(client_seed, case: :lower)
combined_input  = "#{server_seed}:#{client_seed_hex}:#{nonce}"
combined_seed   = :crypto.hash(:sha256, combined_input)
# combined_seed :: binary, 32 bytes

Both seeds are expressed as lowercase hex before concatenation. The nonce is a plain decimal integer (no padding). Given identical inputs, any SHA-256 implementation in any language will produce identical output — this is why the scheme is cross-verifiable.

The combined seed has 32 bytes. We use the first N of them — where N is the number of flips in the round — and turn each byte into heads or tails by a single threshold.

def generate_flip_results(combined_seed, num_flips) do
  for i <- 0..(num_flips - 1) do
    byte = :binary.at(combined_seed, i)
    if byte < 128, do: :heads, else: :tails
  end
end

Each byte takes values 0–255 uniformly. Bytes 0–127 (half of them) produce heads. Bytes 128–255 (the other half) produce tails. Exactly 50/50, unbiased. No modular-arithmetic slop, no off-by-one that skews the distribution by a fraction of a percent.

Every settled game record on Blockster exposes five pieces of data: server seed, client seed (or the bet params used to build it), nonce, number of flips, and the resulting flips. With those five, you can verify the outcome on your own machine in about ten lines of code.

1. 1
   Grab the on-chain commitment

   Look up your bet's on-chain BetOrder via Solscan or the RPC. Pull the commitment_hash field (32 bytes). This is what the settler promised, recorded before you bet. If your bet has been settled, the BetOrder has been closed — use the BetPlaced event that logged commitment_hash at placement time.

2. 2
   Grab the revealed server seed

   At settlement, the BetSettled event is emitted with the raw server_seed as a [u8; 32]. Decode it from base64 or hex depending on your tool. The game's own settled page also shows it.

3. 3
   Check the commitment

   Compute sha256(server_seed_bytes). It must equal the commitment_hash exactly. If it doesn't, the chain rejected the settlement — it never happened.

4. 4
   Reconstruct the client seed

   Concatenate your user ID, bet amount (as a decimal string), vault type, difficulty, and predictions (comma-separated) with colons: "42:1.0:sol:1:heads,tails". SHA-256 that string. That's your client_seed — 32 bytes.

5. 5
   Compute the combined seed

   Turn both seeds into lowercase hex. Concatenate server_hex + ":" + client_hex + ":" + str(nonce). SHA-256 the whole string to get 32 bytes.

6. 6
   Read the flips

   Take the first N bytes (where N is the number of flips in your round). For each, heads if <128, tails otherwise. These must match what the UI showed you.

import hashlib

def verify_flip(
    server_seed_hex: str,     # from BetSettled event (64 hex chars)
    commitment_hex: str,      # from BetPlaced event  (64 hex chars)
    user_id: int,             # your Blockster user_id
    bet_amount: float,        # e.g. 1.0
    vault_type: str,          # "sol" or "bux"
    difficulty: int,          # e.g. 1
    predictions: list,        # ["heads", "tails"]
    nonce: int,
) -> list:
    server_bytes = bytes.fromhex(server_seed_hex)

    # 1. commitment matches
    assert hashlib.sha256(server_bytes).hexdigest() == commitment_hex

    # 2. rebuild client seed
    client_input = f"{user_id}:{bet_amount}:{vault_type}:{difficulty}:{','.join(predictions)}"
    client_bytes = hashlib.sha256(client_input.encode()).digest()
    client_hex   = client_bytes.hex()

    # 3. combined seed
    combined_input = f"{server_seed_hex}:{client_hex}:{nonce}"
    combined = hashlib.sha256(combined_input.encode()).digest()

    # 4. derive flips
    flips = ["heads" if combined[i] < 128 else "tails" for i in range(len(predictions))]
    return flips

const { createHash } = require("crypto");

function sha256Hex(input) {
  return createHash("sha256").update(input).digest("hex");
}
function sha256Bytes(input) {
  return createHash("sha256").update(input).digest();
}

function verify({ serverSeedHex, commitmentHex, userId, amount, vault, difficulty, predictions, nonce }) {
  const serverBytes = Buffer.from(serverSeedHex, "hex");
  if (sha256Hex(serverBytes) !== commitmentHex) throw new Error("commitment mismatch");

  const clientInput = `${userId}:${amount}:${vault}:${difficulty}:${predictions.join(",")}`;
  const clientHex = sha256Hex(clientInput);
  const combined = sha256Bytes(`${serverSeedHex}:${clientHex}:${nonce}`);

  return predictions.map((_, i) => combined[i] < 128 ? "heads" : "tails");
}

Let's walk through a real example with concrete numbers. Suppose player 42 bets 0.1 SOL on difficulty +2 (Win All of 2 flips, 3.96×), predicting heads then tails, at nonce 7. The server happens to pick seed 0xa1b2...c3d4 (32 bytes).