Skip to main content

Provably Fair

A guide to understanding our Provably Fair System

T
Written by Theodore at Lastpack

The outcome of every pack you rip on Lastpack is decided before you see the card.
​

Using our Provably Fair System you can verify the math yourself and confirm we did not change anything.

What is Provably Fair?

Think of it like a sealed envelope. To keep things fair, we lock in your result as if a letter was placed in an envelope.

  1. Before you Rip - we sealed the envelope:
    Our server generated a random secret called the server seed, then published the Server Seed Hash on our back end before your Rip.
    ​

  2. When you Ripped - you signed the envelope:

    Your browser sends a client seed plus the pack details (pack version, pack id, pull number, etc). This combined makes your signature, unique to yourself.
    ​

  3. After your Rip - we opened the envelope:

    Once the card is revealed, we show you the original server seed. Anyone can hash this and verify the fingerprint matches that from step 1. If it matches, it proves there was no change to the seed or outcome after seeing your result.

Ripping a Pack

To get started, you will need to choose your pack and rip it.

When the card drawn appears, click on it to see further details, and then select "Verify Pull"

This opens the verification window, showing how we proved this pull was fair. At the bottom you can click "check the math yourself" for further details.

This opens the Verification Calculator specific to that Rip, showing the inputs used to generate your pull.

How Cards are Chosen

Once the server seeds are locked in, your card is picked using Cryptography.

Here's a quick overview of what you see on the Check the math yourself page.
​

  1. Build the message

    We use a fixed format message string. This is formed from:

    1. Your client seed (cs)

    2. The pack version and id (pv, pvi)

    3. the pull number (n)

    4. a retry counter (sn)

    5. an internal counter (c)

  2. Hash it

    We run the message through HMAC-SHA256 using the server seed as the key. This gives a hex value shown in the Hash It section.

  3. Randomize the Hash

    The first 8 bytes of the hash are read as 64-bit unsigned integer (uint64).
    ​
    We shrink this big number down so it fits the total odds of the pack (totalWeight). That gives us a random point between 0 and totalWeight - 1, which we use to pick your card.
    ​
    If the number would introduce bias, we discard it and move to the next 8-byte window and bump the retry counter. This is called rejection sampling, and keeps the distribution perfectly fair.

  4. Mapping to a Card

    Every card slot in the pack has a weight. Adding the weights together returns totalWeight.
    ​
    We walk up the cumulative odds ladder using your sample value. That tells us which slot it lands in. That slot index is the Computed Slot, and the card in that slot is the one you see on your screen when you draw.


You can verify all of the above steps yourself, simply click "Run it yourself" at the bottom of the page, and it will provide the code required to verify this.

Did this answer your question?