What is a provably fair lottery, and how do you check one?

A provably fair lottery is one where you do not have to trust the operator: the rules, the money and the random draw are all public, and anyone can recompute who should have won. This guide explains what that means in practice, what can still go wrong, and how to check a draw yourself.

The problem with "trust us"

In a traditional online lottery, the operator runs the draw on its own servers. You see the result, but you cannot see how it was produced. The operator could, in principle, pick a number that suits it, sell more tickets after the result is known, or simply not pay. Licences and audits reduce that risk, but you still have to trust someone.

Blockchains make a different model possible. When the tickets, the prize money and the random number all live on a public chain, a lottery can be verified rather than trusted. That is what "provably fair" should mean — and it is worth being precise, because the phrase is also used loosely as a marketing label.

What makes a lottery provably fair

A lottery is provably fair when all of the following are true and publicly checkable:

1. The rules are code, and the code is public. The lottery runs as a smart contract whose source code is published and verified on a block explorer, so the code you read is exactly the code that runs.
2. The money sits in that contract. Stakes go straight into the contract, not to a company wallet. Anyone can look up how much the contract holds.
3. The random number cannot be known in advance or changed. It comes from a source that nobody — including the operator — can predict or influence, and it arrives with a cryptographic proof.
4. The winner follows from public math. Given the random number and the list of tickets, there is exactly one correct winner, and anyone can compute it.
5. The payout is automatic. The contract credits the prize to the winner; the operator cannot hold it back.

If any one of these is missing, you are back to trusting someone. A site that shows you a "server seed" and a hash, for example, is verifiable only as far as that seed was really generated before the draw — and the site generated it.

Where the randomness comes from

Randomness is the hard part. Smart contracts are deterministic: every node must reach the same result, so a contract cannot simply "roll a die". Values that look random, such as a block's timestamp or hash, can be influenced by whoever produces the block.

The standard solution is a verifiable random function (VRF) run by an oracle network. The most widely used is Chainlink VRF. The contract requests a random number; the oracle returns it together with a proof, and a contract on-chain checks the proof before the number is accepted. A number that does not match the proof is rejected, so the oracle cannot swap in a value it likes. We explain the details in Chainlink VRF explained.

How the winner is computed

Once the random number is on-chain, the rest is arithmetic. DecentraLotto tickets are numbered in purchase order. The ticket or seat price is shown on the game card; Stack uses a separate seat price. For a single-winner draw:

winning ticket = random number mod tickets sold

If 1,000 tickets were sold and the random number modulo 1,000 is 49, ticket #49 wins, and the contract looks up who bought it. In a draw with several prize places — such as our Stack raffle — each place uses its own random number and is drawn from the tickets that have not won yet.

How to check a draw yourself

You should not have to take any of this on faith, including from us. On DecentraLotto the draw checker does the whole check in your browser, reading everything directly from the blockchain:

1. It reads the finished round from the lottery contract: how many tickets were sold and which randomness request belongs to it.
2. It finds Chainlink's answer to exactly that request — the event emitted by the VRF coordinator in the settlement transaction.
3. It derives the random numbers from Chainlink's seed, the same way the coordinator does.
4. It recomputes the winning tickets with the contract's own algorithm and asks the contract who holds them.
5. It compares the result with the prizes credited in the contract's events. Withdrawal to a wallet is a separate transaction.

If every step matches, the draw was decided by the random number and nothing else. You can also do it by hand with a block explorer: open the settlement transaction, take the seed from the RandomWordsFulfilled event, compute keccak256(abi.encode(seed, 0)), and take it modulo the ticket count.

To choose a real draw, open the round archive, select a completed draw with winners and follow its verification link. Compare its round ID, winning tickets and prize credits with the settlement transaction. A round closed with a return has no winning ticket; check its closing transaction instead. If no completed draw with winners is listed yet, there is no winner result to verify.

What "provably fair" does not promise

Being honest about the limits matters as much as the guarantees:

• It does not change the odds. A fair draw is still a lottery. Most entries lose, and a fair process only guarantees that your chance is exactly what the rules say.
• It does not make the code bug-free. Smart contracts can contain mistakes. Verified source code lets experts look for them; an independent audit adds more assurance. (Our contract has not been formally audited yet — see About.)
• It depends on the infrastructure. Oracles, stablecoins and networks can fail. A good contract plans for that — for example, by refunding everyone if the oracle does not answer within a set time.
• It does not replace the law. Whether you may play depends on where you live.

A quick checklist

Before you play anywhere, ask:

• Can I read the verified contract on a block explorer?
• Is the prize money held by that contract, and can I see the balance?
• Where does the random number come from, and does it come with a proof?
• Can I recompute a past winner myself, without the site's help?
• Who can move the money, and what can the owner change?

We go through these checks in more detail in Is a crypto lottery legit? If a site cannot answer them, "provably fair" is just a slogan.