POWERGACHA
FAIRNESS · COLLECTOR CRYPT VRF

Built so nobody - including us - can rig it.

Every live draw's winner comes from an on-chain ECVRF proof (RFC 9381) under a key we froze on-chain before any draw ran — so the operator cannot bias which holder wins. Verify the proof in your browser or on Collector Crypt. Older draws used commit-reveal; the verifier below auto-detects and checks either.

FOUR STEPS - ONE VIEWPORT
Freeze > Snapshot > Prove > Roll
  1. Freeze
    We froze our VRF key on-chain before any draw
    Our ECVRF public key is registered + FROZEN on-chain (Collector Crypt VRF program) under a fixed owner + label. Once frozen it cannot be swapped — every proof verifies against this one key.
    vrf_authority: frozen(pk, owner, label)
  2. Snapshot
    Every holder balance is recorded at the close slot
    When the window closes we record a Merkle root of every eligible $GACHA balance at that exact Solana slot. Nobody touches your balance — we just take a tamper-evident snapshot the weighted pick runs over.
    snapshotMerkleRoot = MerkleRoot(holders[closeSlot])
  3. Prove
    alpha binds the slot, we publish the ECVRF proof
    The proof input alpha = sha256(slotHash ‖ drawId) binds the FUTURE slot blockhash — nobody (including us) can precompute it. We produce the ECVRF proof and commit sha256(proof) on-chain.
    alpha = sha256(slotHash ‖ drawId)
  4. Roll
    beta[0:32] picks the winner
    The roll is the first 32 bytes of the VRF output (beta). We walk the prefix-sum of weights — first holder whose slice covers the offset wins. verifyVRF confirms the proof; the roll is forced by it.
    roll = beta[0:32] (beta = ECVRF output)
SECTION 02

Recompute the roll. Right here. In your browser.

Paste any draw number. For a VRF draw the widget recomputes the alpha binding, verifies the ECVRF proof itself (verifyVRF, RFC 9381) against the operator key, and confirms the roll IS beta[0:32] - all in your browser. For an older commit-reveal draw it re-runs the same HMAC-SHA-256 recompute. If our published roll does not match, the badge turns red. Paste a PG Packs spin id instead and it opens that pull's own fairness page, which runs the same in-browser ECVRF check on the pack.

● ON-CHAIN VERIFIER
Paste a draw number or a pack spin id. Verify it in your browser.

Try #2270, #2263, #2245 - or paste a PG Packs spin id from any pull

Enter a draw number or a pack spin id to verify.

Want the full story of a single draw — which cards were in the pot, who won at what odds, and this proof, all on one page? Every draw has one: open any row in history and hit its FAIRNESS link, or go to /raffle/fairness/<draw id> directly.

REFERENCE IMPLEMENTATION

Copy-paste. Run it locally. Same answer.

fairness.tsTypeScript
import { verifyVRF, vrfProofToHash } from '@collectorcrypt/vrf-client';
import { sha256 } from '@noble/hashes/sha2';

// alpha binds the resolved slot hash + draw id (32B slot hash || utf8 id)
const alpha = sha256(concat(slotHashBytes, utf8(String(drawId))));

// 1. the ECVRF proof must verify under our FROZEN operator key
const ok = verifyVRF(operatorPubkey, alpha, proof); // RFC 9381 -> true

// 2. the published roll must be the first 32 bytes of the VRF output
const roll = vrfProofToHash(proof).slice(0, 32); // === published rollHex

Node ≥ 20 · no dependencies · same output as the browser widget.

SECTION 03

Every game gets the same verifier.

The roll is produced the same way everywhere - an ECVRF proof under our frozen key, with alpha bound to a slot hash nobody can precompute. What differs is only what each game does WITH that roll. Every mode has its own per-round fairness page that recomputes the binding, verifies the ECVRF proof in your browser, and confirms the published roll IS beta[0:32].

SECTION 04

What we cannot do