Prove. Commit. Verify.
The operator cannot bias which holder wins. The roll is an RFC 9381 ECVRF output keyed by our on-chain frozen key, its input bound to the resolved slot hash so it cannot be precomputed, and the winner is the holder whose weighted slice of the snapshot covers the roll. Recompute AND verify everything — the binding, the ECVRF proof, the roll — right here in your browser.
- FreezeWe froze our VRF key on-chain before any drawOur ECVRF public key is registered + FROZEN on-chain (Collector Crypt VRF program) under a fixed owner + label. Once frozen it cannot be swapped — every proof verifies against this one key.vrf_authority: frozen(pk, owner, label)
- SnapshotEvery holder balance is recorded at the close slotWhen the window closes we record a Merkle root of every eligible $GACHA balance at that exact Solana slot. Nobody touches your balance — we just take a tamper-evident snapshot the weighted pick runs over.snapshotMerkleRoot = MerkleRoot(holders[closeSlot])
- Provealpha binds the slot, we publish the ECVRF proofThe proof input alpha = sha256(slotHash ‖ drawId) binds the FUTURE slot blockhash — nobody (including us) can precompute it. We produce the ECVRF proof and commit sha256(proof) on-chain.alpha = sha256(slotHash ‖ drawId)
- Rollbeta[0:32] picks the winnerThe roll is the first 32 bytes of the VRF output (beta). We walk the prefix-sum of weights — first holder whose slice covers the offset wins the whole pot. verifyVRF confirms the proof; the roll is forced by it.roll = beta[0:32] (beta = ECVRF output)
Recompute the roll. Right here. In your browser.
The widget recomputes the VRF input alpha = sha256(slotHash ‖ drawId), verifies the ECVRF proof itself (verifyVRF, RFC 9381) against the operator key, and confirms the published roll IS beta[0:32] — the entire chain, in your browser. Collector Crypt is an independent cross-check that the operator key is the one frozen on-chain.
- VRF authority
- 13R5zhNirknRrskNyEmyZuC5NNEQWcSwN5w8BUn6qnp8
- Slot
- 435016632
- Slot hash
- b56fd8be9788e8a6f95fd63e55ff068d492b1c5120070a29a3337fcd8b5a1591
- alpha (published)
- d9983fe0d527967d7a4b24ea5f352de3358af5304dc5331c0e43e5673d793990
- alpha (recomputed)
- d9983fe0d527967d7a4b24ea5f352de3358af5304dc5331c0e43e5673d793990
- Alpha binds slot
- ✓ alpha === sha256(slotHash ‖ drawId)
- Operator VRF key
- e75d1717431b1c691084425d0a0d96f094c7e72fb9d35a49b7052326d8f48f0e
- ECVRF proof valid
- ✓ verifyVRF(operatorKey, alpha, proof) === true (in-browser)
- beta (VRF output)
- 3a60d4ee24126ce8916b9c839d72f126a24a225faa0decb56399b1238725b5f0e01dd7b4b8e1987d9128a9b822161779a4eac0d361e36e1e765a955a53bbdb34
- Published roll
- 0x3a60d4ee24126ce8916b9c839d72f126a24a225faa0decb56399b1238725b5f0
- Roll is beta[0:32]
- ✓ rollHex === beta[0:32]
- Snapshot root
- 82dfa9b3886b027ceb4df54c3a294bbdd255e2e73e5702bc66f46deb199ac060
- Holders
- 2,068
- Eligible total
- 895,635,243 GACHA
- Winner balance
- 2,000,000 GACHA
- Winner odds
- ✓ balance / eligible = 0.2233% (matches published)
- On-chain commit
- 12tyxZBTWhf16bBAi4CZgPDKgJqfxF1VqKYxbi7WqmDf
- VRF commit tx
- xdHJjAnZuJmEXHHnLzschKT1MsCn4USGjyxHWXJuddkqo8aCUQ6mnwUMr6X5tLKFTCKSM93Un94DHbCsceTMW6q
- Owner (verify input)
- HuTNYccZn2U3sNpJnVTgyi9XZFRo9GjbJHBjc1F2tWYL
- Label (verify input)
- raffle
- Memo (verify input)
- pg-raffle-1655
- Proof (verify input)
- ae68eb700443df286947b536451cce4a74fc23644252c6b78492797ea258a2f96b5b6749176e2e0e1562179fc5d6eddda29dc8ae7ed3f835a1e4eaba0061926f0693f2032b1b641dea19375f3c474704
Verified in your browser: alpha binds the public slot, the ECVRF proof checks out under the published operator key, and the roll IS beta[0:32]. The winner is then the balance-weighted pickWinner(snapshot, roll) walk — the snapshot itself is committed by the Merkle root above (not downloaded here), so the winner + odds rows are informational.
1 card worth $53 opened this window — 5HJ6…xveS held 0.22% of the eligible snapshot and won the pot.
- Win chance
- 0.22%
- About 1-in-N
- 448
- Winner balance
- 2,000,000 GACHA
- Eligible pool
- 895,635,243 GACHA
Copy-paste. Run it locally. Same answer.
import { verifyVRF, vrfProofToHash } from '@collectorcrypt/vrf-client';
import { sha256 } from '@noble/hashes/sha2';
// alpha binds the resolved slot hash + draw id (32B slot hash || utf8 id)
const alpha = sha256(concat(slotHashBytes, utf8(String(drawId))));
// 1. the ECVRF proof must verify under our FROZEN operator key
const ok = verifyVRF(operatorPubkey, alpha, proof); // RFC 9381 -> true
// 2. the published roll must be the first 32 bytes of the VRF output
const roll = vrfProofToHash(proof).slice(0, 32); // === published rollHex
// 3. the winner: map roll into [0,1), walk the snapshot's weight
// prefix-sum — the first holder whose slice covers it wins.Node ≥ 20 · no dependencies · same output as the browser widget.