How it works

A draw, start to finish

Five steps, in this order, every time. The order is the whole point: the entry list is fixed and published before the random number exists, so nobody can fit the list to the number or the number to the list.

Sales close.The entry list is locked. Nothing can be added afterwards.
The commitment goes public.A fingerprint of the entries and the future beacon round number are published here before the random number exists.
The beacon fires.drand, the public random number beacon run by the League of Entropy, publishes that round's number at the stated time. It cannot be chosen or brought forward by anyone.
Winners are worked out.The number plus the locked list gives the winning tickets. The ball machine on the live screen just shows the result.
Anyone checks.The record page re-does the sum in your browser. Players never have to take the operator's word.

The sums, exactly

Everything a record page recomputes in your browser. The same functions run on the operator’s site, on Entropy’s API when a record arrives, and on the record page.

Commitment: A JSON object with its keys sorted: the fingerprint of the entries, how many entries, the highest ticket number, how many winners, any excluded numbers, the beacon chain and the future round. commitmentHash is its SHA-256. It is published before the round exists.
Entries hash: SHA-256 of the eligible ticket numbers sorted and joined by newlines. The numbers themselves are published as entries.json.
The beacon: drand quicknet, a new signed number every 3 seconds. Each round’s signature is a BLS12-381 signature on the round number, checkable against the chain’s public key by anyone, with any drand client.
Seed: HMAC-SHA256 with the round signature bytes as the key and the commitment hash as the message.
Attempts: For i = 1, 2, 3 ... take HMAC-SHA256(seed, the decimal string of i), read the first 8 bytes as an unsigned big-endian number v. Reject v if it is at or above 2⁶⁴ minus (2⁶⁴ mod N), which keeps every ticket equally likely. Otherwise the pick is (v mod N) + 1 over every ticket number, or position v mod N in the sorted entry list when the draw is over sold tickets only. A number that is unsold, already drawn or excluded is a recorded miss; the next attempt is taken, until the winner count is met.
Instant wins: Before the first ticket sells the operator publishes SHA-256 of a secret salt, a newline, then every “ticket:prize” pair sorted by ticket number and joined by newlines. After the competition closes the salt and the list are published and the fingerprint is recomputed.

The ledger

Every record is chained to the one before it: bodyHash is SHA-256 of the record’s canonical JSON (keys sorted at every level), prevHash is the previous record’s recordHash (64 zeros for the first), and recordHash is SHA-256 of prevHash followed by bodyHash. Change or remove any record and every hash after it changes. Once a day Entropy signs a digest of the day’s record hashes with an Ed25519 key whose public half is on the digests page. The database itself refuses updates and deletes on the ledger tables.

The honest limit

drand can be checked by anyone, and so can every sum on this site, in your own browser. Our use of it has not been certified by a testing laboratory. Say it plainly: publicly verifiable, by anyone, in the browser. Not lab-certified.

A draw made on a physical ball machine during a live stream (a “live manual” draw) is locked here the same way, but its result is not derived from the beacon, so Entropy does not record a result for it.