CHECK US

drand is a public randomness beacon run by a consortium of universities and companies with no connection to us. It has published a signed random value every 3 seconds since 2023-08-23, and it will keep doing so whether or not this game exists.

We cannot see a value before it lands, cannot change it afterwards, and cannot substitute one. If no valid beacon arrives, the round does not settle at all — there is no fallback number anywhere in the code, and you dig your stake back out.

A round that has closed is sealed by a separate transaction, and it is the seal that names the beacon — by arithmetic, before that value exists. Nobody types a round number in. It is a division:

round = floor((sealed_at + 60 - 1692803367) / 3) + 2

The + 2 is the security property rather than a rounding preference: a beacon published at the sealing instant is not eligible, because somebody watching the beacon could otherwise name a round whose value already existed. The 60-second lead is there because this chain's clock trails wall clock by a few seconds, and a lead shorter than that drift has the same hole in it.

Anyone may send that seal, and in practice we are the ones who do. So the honest version is not that nobody chooses anything — whoever seals picks the moment, and sealed_at is sitting right there in the formula. What the arithmetic removes is any gain from picking it. Every moment we could choose names a beacon that will not exist for at least another 60 seconds, so the choice is between values nobody has seen yet, us included.

It checks that the field follows from the beacon. The seed is keccak256(signature), the thousand blocks are a Fisher–Yates shuffle of the published multiset driven by that seed, and the box below re-runs both in your browser. That is the half people actually doubt — that the ground was arranged after somebody saw where the money was.

It does not check that the signature is genuinely drand's. That needs a pairing over BLS12-381, the chain does it in DrandVerifier.sol against drand's public key before a round is allowed to settle, and a round with a forged beacon cannot get far enough to appear here at all. We would rather name the two halves separately than blur them into a phrase like “provably fair”.

Not checking it here does not mean taking our word for it. The command further down asks the deployed verifier that question directly, over eth_call, from an RPC you pick — and prints the verdict. A browser is the wrong place for a pairing; it is not the only place you can get one done.

Everything the box above does, plus the half it cannot. It reads an RPC you choose and nothing of ours, and it will only exit clean if all five of these hold:

• ✓Two independent drand operators serve the same signature for the round this settlement committed to. Agreement is not proof — the next line is — but disagreement stops it before any arithmetic runs.
• ✓The seed stored on-chain is keccak256 of that signature.
• ✓The deployed verifier confirms the signature really is drand's, against the group key compiled into it. This is the BLS half, and this is where you get it.
• ✓The grid it derives locally matches the one the contract derives, block for block — so the TypeScript and the Solidity have not drifted apart.
• ✓The multiset matches the one pinned when the round opened, not whatever the config says today.

pnpm --filter @gold-mine/verify verify -- \
    --rpc https://rpc.mainnet.chain.robinhood.com \
    --mine <RocketLaunch address — nothing is deployed yet> \
    --round <round id>

Nothing is deployed yet, so there is no address to fill in and no round to check. Both appear here the moment there are.

Beacon

quicknet

Scheme

bls-unchained-g1-rfc9380

Period

3s

Chain hash

52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971

Group public key

83cf0f2896adee7eb8b5f01fcad3912212c437e0073e911fb90022d3e760183c8c4b450b6a0a6c3ac6a5776a2d1064510d1fec758c921cc22b0e17e63aaf4bcb5ed66304de9cf809bd274ca73bab4af5a6e9c76a4bc09e76eae8991ef5ece45a

The group key is the one that decides: DrandVerifier.sol holds it as a compile-time constant with no setter, so pointing settlement at a different beacon would take a new contract at a new address, in public. These are drand's own published values, not ours to set. If they do not match what drand serves at /v2/beacons/quicknet/info, then something here is wrong and we would rather you saw it.