Fasty VendorAll docs
Open the panel

Provably Fair PRO ​

"Provably fair" means the player doesn't have to trust you or Fasty: they can check that their result was not chosen by anyone. It is the same idea used by the big case-opening sites.

The proof page ​

After every play, the player gets a link to the proof of that play. When the page opens, their own browser redoes the math (without relying on the Fasty server) and shows the result:

The proof page: what they won, the three checks, the odds and how it works.
The proof page: what they won, the three checks, the odds and how it works.

Fair draw, proven. "Checked just now, in your browser, without relying on our server. Nobody picked this result."

Three checks, all done in the browser:

CheckWhat it proves
The secret existed before the playThe secret used in this play leads back to an "anchor" published before the first play. It can't have been swapped later.
The odds are the published onesThe odds table shown is exactly the one used in the math.
The math gives this itemRedoing the draw with the secret, the machine and the player gives exactly the item that was delivered.

Below, the odds of every item with the band where the drawn number landed, How it works in plain words, and the Technical data for anyone who wants to check by hand.

How it works, in plain words ​

  1. Secrets are locked in first. Before the first play, the server creates a long chain of secrets, each one made from the next. It publishes only the end of the chain (the anchor) on the machine's public page.

  2. Each play uses the next secret. Because each secret is linked to the one before it, nobody can swap a secret without breaking the chain.

  3. The result is a calculation. The item comes from a calculation (HMAC-SHA256) that mixes the play's secret, the machine, the play position, the player and the odds table. Change any of them and the result changes, so nobody can aim at a result.

  4. After the play, the secret is revealed. With it, anyone can redo the math and get the same item.

For the technically curious
  • Each machine has its own chain of 10,000 secrets. s(i-1) = SHA256(s(i)); the anchor s(0) is public before play 1. Play k reveals s(k), and SHA256 applied k times leads back to the anchor.
  • The draw is HMAC-SHA256(key = s(k), message = "fasty-gacha-v2:<machine>:<chain>:<k>:<SHA-256 of the player's UUID>:<hash of the odds table>").
  • Weights are whole numbers with a total T ≤ 1,000,000. The 32-byte HMAC is read as 8 blocks of 4 bytes; a block is rejected if it would bias the result (u ≥ ⌊2³²/T⌋·T), otherwise u mod T lands in an item's band, in table order.
  • The odds table hash is the SHA-256 of JSON.stringify([[id, weight], …]) in table order.
  • When a chain runs out, a new one starts and its anchor is published before it is used.

Players stay anonymous ​

The proof includes the player only as a SHA-256 hash of their UUID, so anyone can verify the play without learning who played. The player can confirm the play is theirs with "Is it you? Paste your UUID to check": the check happens in their browser.

Pity in the proof ​

When pity changed the odds of a play, the proof shows a fourth check: Pity followed the rule. It tells the player "This was this player's play #N since their last rare", shows the collection's normal table, redoes the pity formula and confirms it gives exactly the table used. It also links to the player's previous play, so the streak can be followed back play by play.

What the store owner can't do ​

  • Pick or change a result: the secret is fixed before the play and the math is public.
  • Change the odds of a play after the fact: the odds table is part of the calculation, and the proof shows it.
  • Change odds silently: changes apply to the next plays only, and the machine's history shows when they changed.

Note that the store owner can change the odds for future plays at any time (like any shop changes its prices). The proof guarantees that each play used the odds it shows.