Prove. Commit. Verify.
The operator cannot bias which holder wins. The roll is an RFC 9381 ECVRF output keyed by our on-chain frozen key, its input bound to the resolved slot hash so it cannot be precomputed, and the winner is the holder whose weighted slice of the snapshot covers the roll. Recompute AND verify everything — the binding, the ECVRF proof, the roll — right here in your browser.
- FreezeWe froze our VRF key on-chain before any drawOur ECVRF public key is registered + FROZEN on-chain (Collector Crypt VRF program) under a fixed owner + label. Once frozen it cannot be swapped — every proof verifies against this one key.vrf_authority: frozen(pk, owner, label)
- SnapshotEvery holder balance is recorded at the close slotWhen the window closes we record a Merkle root of every eligible $GACHA balance at that exact Solana slot. Nobody touches your balance — we just take a tamper-evident snapshot the weighted pick runs over.snapshotMerkleRoot = MerkleRoot(holders[closeSlot])
- Provealpha binds the slot, we publish the ECVRF proofThe proof input alpha = sha256(slotHash ‖ drawId) binds the FUTURE slot blockhash — nobody (including us) can precompute it. We produce the ECVRF proof and commit sha256(proof) on-chain.alpha = sha256(slotHash ‖ drawId)
- Rollbeta[0:32] picks the winnerThe roll is the first 32 bytes of the VRF output (beta). We walk the prefix-sum of weights — first holder whose slice covers the offset wins the whole pot. verifyVRF confirms the proof; the roll is forced by it.roll = beta[0:32] (beta = ECVRF output)
Recompute the roll. Right here. In your browser.
The widget recomputes the VRF input alpha = sha256(slotHash ‖ drawId), verifies the ECVRF proof itself (verifyVRF, RFC 9381) against the operator key, and confirms the published roll IS beta[0:32] — the entire chain, in your browser. Collector Crypt is an independent cross-check that the operator key is the one frozen on-chain.
- VRF authority
- 13R5zhNirknRrskNyEmyZuC5NNEQWcSwN5w8BUn6qnp8
- Slot
- 445606446
- Slot hash
- 0ef826e500a0a7a2035b3b07be0700f453fa7fecd033239dca56ec8cda42760c
- alpha (published)
- 559759e1c50f95068b7a4af7d3cb4ff6b77cd53a9382c913a384404e515bbf4e
- alpha (recomputed)
- 559759e1c50f95068b7a4af7d3cb4ff6b77cd53a9382c913a384404e515bbf4e
- Alpha binds slot
- ✓ alpha === sha256(slotHash ‖ drawId)
- Operator VRF key
- e75d1717431b1c691084425d0a0d96f094c7e72fb9d35a49b7052326d8f48f0e
- ECVRF proof valid
- ✓ verifyVRF(operatorKey, alpha, proof) === true (in-browser)
- beta (VRF output)
- b4952f958bbd19a750735c791c789d843a3b0310081e9c7a206e984545c5bf815ac29c8458b690f6e2a4d588e04ef2bfad572bcb42012cdc342d6965d160b13a
- Published roll
- 0xb4952f958bbd19a750735c791c789d843a3b0310081e9c7a206e984545c5bf81
- Roll is beta[0:32]
- ✓ rollHex === beta[0:32]
- Snapshot root
- 11d3f2102de90575f14d477825311f3a86378d9e3bf6e4dc9e3917e04236abb4
- Holders
- 1,925
- Eligible total
- 837,458,438 GACHA
- Winner balance
- 8,857,218 GACHA
- Winner odds
- ✓ balance / eligible = 1.0576% (matches published)
- On-chain commit
- 12Z2UFsF3qscrGEiqhAZbWkBkg4auPdh3VX3Tp2awDTU
- VRF commit tx
- 3zvmrESDP8jJYkpQTaWohMqpPfnZEsTZXfShDeaXJjmdAtafahzQ1xffceeYKkmeRDc1joDGAGd7ENnoBbM1tjF3
- Owner (verify input)
- HuTNYccZn2U3sNpJnVTgyi9XZFRo9GjbJHBjc1F2tWYL
- Label (verify input)
- raffle
- Memo (verify input)
- pg-raffle-2655
- Proof (verify input)
- 0eabe03031c822abb051590405eb47365fd87bdd5522fe310ff273ddd940b53a3297121cc105dd73bb10b1f4d4174803c05a68a32a28a8e2c35e07e0abbc4999f661d2d3698a036f7407da7c82c7050d
Verified in your browser: alpha binds the public slot, the ECVRF proof checks out under the published operator key, and the roll IS beta[0:32]. The winner is then the balance-weighted pickWinner(snapshot, roll) walk — the snapshot itself is committed by the Merkle root above (not downloaded here), so the winner + odds rows are informational.
1 card worth $20 opened this window — 12Nr…LMCj held 1.06% of the eligible snapshot and won the pot.
Copy-paste. Run it locally. Same answer.
import { verifyVRF, vrfProofToHash } from '@collectorcrypt/vrf-client';
import { sha256 } from '@noble/hashes/sha2';
// alpha binds the resolved slot hash + draw id (32B slot hash || utf8 id)
const alpha = sha256(concat(slotHashBytes, utf8(String(drawId))));
// 1. the ECVRF proof must verify under our FROZEN operator key
const ok = verifyVRF(operatorPubkey, alpha, proof); // RFC 9381 -> true
// 2. the published roll must be the first 32 bytes of the VRF output
const roll = vrfProofToHash(proof).slice(0, 32); // === published rollHex
// 3. the winner: map roll into [0,1), walk the snapshot's weight
// prefix-sum — the first holder whose slice covers it wins.Node ≥ 20 · no dependencies · same output as the browser widget.