Fairness & randomness

How the winning square is drawn, and how to verify it yourself.

The winning hideout must be unpredictable AND unmanipulable — by players, by us, and by the chain's sequencer. Lootwood draws it from drand, the public randomness beacon run by the League of Entropy— the same beacon used across the industry. We don't roll the dice; we just read a die that dozens of independent organizations rolled together, and prove the roll on-chain.

How a draw is made

drand emits a fresh random signature every 3 seconds, each tied to a round number by a fixed schedule. When a Lootwood round closes at time T, the contract already knows exactly which future drand round it will use — (T − genesis) / 3 + 2— and that beacon hasn't been produced yet. Once it exists, a keeper relays the signature and the contract:

1. verifies the BLS signature against drand's
   public key  (on-chain, EIP-2537 precompiles)
2. winningSquare = keccak256(signature) % 30

Because the beacon is fixed before it's generated, nobody — not a player, not a keeper, not us — can know or nudge the result while bets are open. And because the contract verifies the signature itself, a keeper can't feed it a fake number: an invalid signature simply reverts.

There is no second source to grind against. Olderdesigns mixed a keeper secret with a block hash, which let a withholder force a re-roll; we removed all of that. drand is the only input. If the beacon were ever unavailable for hours, the round doesn't pick a convenient backup — it hits emergencyAbort() and every player pulls a full refund. Fairness never trades off against liveness.

Verify any past round

Every finalized round publishes its winning square and the drand round used on-chain. Punch in a round number to read them straight from the contract, then cross-check the signature at drand.love:

Verify a round

Why you can trust it on mainnet

drand verification needs the BLS12-381 precompiles (EIP-2537). We confirmed empirically that Robinhood Chain mainnet supports them — our full verification suite, including a real beacon check, passes against a fork of mainnet. The beacon key itself is swappable only through a 24-hour timelock, so even a key rotation by the League of Entropy can never brick or hijack the draw without a full day of public notice.

← Economy Contracts →