1the buy — the wallet, the transaction, and the odds — pinned before the winning number exists.
2the commit — one target round, stored on-chain. resolution accepts no other.
3the beacon — drand publishes the number ~6 s later. nobody could compute it sooner.
4the check — three lines of arithmetic, redone right here in your browser.
5the payout — a win pays in the same transaction. a stick is logged with the same rigor.
the arithmetic
draw_i = keccak256(abi.encode(randomness, nonce, i)) mod 1e9
hit_i = draw_i < odds_i (odds fixed at commit, in ppb)
prize = min(target_i, pot_i) (D2: an emptied pot pays nothing)
odds_i = κ · share_i · min(buy, 3% depth) ÷ target_i, capped at 25% per pot. the same numbers the Committed event carries.
the beacon
drand quicknet, a 15-organisation threshold network. the round is fixed when you buy: head + 2 while the verified clock is fresh, or chain-clock round + 2 + M while the relay is idle (flagged "stale"). the number for that round is not published anywhere until ~6–15 s after your buy — and without the network's threshold key nobody can compute it sooner. the contract verifies the BLS signature itself.
the one assumption
the chain has one sequencer that may back-date block timestamps. while the drand clock is fresh the target comes from the verified beacon alone; while it is idle the target comes from the chain clock plus an M-round margin (M = 3 at launch, timelocked). against an honest-but-late sequencer this holds; against a sequencer that back-dates by more than the margin it does not. we say so here rather than not.