Is a crypto lottery legit? 7 checks before you play

Some crypto lotteries are honest, transparent and fair. Others are games where the house can quietly pick the winner, or simply disappear with the pot. These seven checks, all of which you can do yourself in a few minutes, tell them apart.

1. Is the code public and verified?

A legitimate on-chain lottery runs as a smart contract, and its source code is published and verified on a block explorer such as Arbiscan or Etherscan. "Verified" means the explorer compiled the published code and confirmed it matches what is deployed, so the code you read is the code that runs.

How to check: find the contract address on the site (usually in the footer or an "About" page), open it on the explorer and look for the "Contract" tab with a verified badge. No address, or unverified code, is a red flag.

2. Who holds the money?

In a non-custodial lottery, your stake goes straight into the contract and the prize is paid out of it. In a custodial one, you deposit to the operator's wallet and trust them to pay. The second is simply an online casino with extra steps.

How to check: look up the contract's token balance on the explorer. It should roughly match the pots currently in play plus unclaimed prizes. If your deposit goes to an ordinary wallet address instead of a contract, the site holds your money.

3. Where does the randomness come from?

This is the single most important question. If the operator's server generates the random number, the operator can choose it. Hash-based "provably fair" schemes help only if the seed was committed before any bets were placed. On-chain lotteries should use a verifiable random function such as Chainlink VRF, where the number arrives with a proof that is checked on-chain.

How to check: in a draw transaction, look for a request to a known VRF coordinator and its fulfilment event. Randomness from block hashes, timestamps or a server is a warning sign.

4. Can you recompute a past winner yourself?

Fairness you cannot check is just a promise. With the random number and the ticket list public, anyone should be able to repeat the math and arrive at the same winner.

How to check: pick a finished draw and recompute it. On DecentraLotto, the draw checker does it in your browser, straight from the blockchain; you can also do it by hand, as described in What is a provably fair lottery?

5. What can the owner do?

Almost every contract has an owner with some powers. The question is which ones. Reasonable powers: pausing new entries, setting parameters for future rounds, a capped fee. Dangerous powers: withdrawing the pot, changing a running round, choosing the random number, or upgrading the contract to new code without notice.

How to check: read the functions marked onlyOwner in the verified code, or the site's own explanation of them. On DecentraLotto the owner cannot move players' stakes or prizes and the fee is capped at 10% in the code — see How it works.

6. Are the fees clear and capped?

A fair operator tells you exactly what it takes, and the contract enforces it. Watch out for fees that are not in the code, "withdrawal fees" that appear only when you win, or house edges hidden in the odds.

How to check: find the fee in the contract and compare it with the site. Then do the math on a real payout from a past draw. On DecentraLotto the 10% fee applies only to the part a winner gains from other players, never to their own stake.

7. Is the team honest about risks?

Nobody can promise that code is bug-free. What matters is honesty: clear terms, a stated audit status, contact details, and tools for responsible play. A site that claims to be "100% safe" or "guaranteed" is telling you something about itself.

How to check: read the terms and the about page. Is there a contact address? Is the audit status stated plainly? For the record: our contract has not had a formal third-party audit yet, and we say so on our About page.

Red flags at a glance

• "Guaranteed wins", "no-lose" promises that are not backed by code, or winnings that must be "unlocked" with another deposit.
• Referral schemes where you earn mainly by bringing in new players.
• No contract address, or funds sent to a personal wallet.
• Winners you cannot find on-chain.
• Pressure to play: countdowns that reset, "last chance" messages, or offers to recover your losses.
• Anyone asking for your recovery phrase or private key. Never share it — with anyone.

The bottom line

A legitimate crypto lottery lets you verify, rather than trust: public code, money in the contract, verifiable randomness, recomputable winners, limited owner powers, fees in code and honesty about risks. If a site passes all seven checks, the draw is fair — which still means most entries lose, so play only what you can afford and use the limits and breaks we offer.