Independent verification

Check our arithmetic.

Rotate your seed in account settings — that reveals the server seed we had already committed to. Paste it here with your client seed and any entry number to redraw the ticket. The algorithm is printed below so you can run this without us.

Revealed server seedClient seedEntry numberNumbers to match, from that round

The algorithm

Run it without us.

Six distinct numbers in 1–35, drawn by partial Fisher–Yates. Indices come off the HMAC stream four bytes at a time; values at or above the largest clean multiple of the range are discarded, which is what removes modulo bias.

bytes(round) = HMAC_SHA256(
  key = serverSeed,
  msg = clientSeed + ":" + nonce + ":" + round
)

pool = [1..35]
for i in 0..5:
  range = 35 - i
  limit = floor(2^32 / range) * range
  repeat: v = next uint32 from stream
  until v < limit
  j = i + (v mod range)
  swap pool[i], pool[j]

ticket = sorted(pool[0..5])