I'm working on coin toss game for new a new bitcoin gambling website (coinalot.net) and I am trying to make a provably fair gambling algorithm for it.
I would like your opinion please if the following method would work and if it would be fair and secure.
The Game The game is simply a coin toss. You pick heads or tails. If you guess correctly you get 2x your bet, otherwise you lose your bet. There is a ~1% chance that the coin "lands on the edge". In this case you lose no matter what your pick was (this is the house edge).
Method: 1.) Server secretly generates a random nonce (about 30 characters, letters and digits) and a random whole number 0-98.
2.) Server calculates a hash (eg. sha256) from all this to present to the player on the web page in the next step.
3.) The page is presented to the player with the hash as calculated above, two buttons ("heads" and "tails"), an inputbox to enter his bet amount and another inputbox to enter a number (already filled with a default number 0-98 using javascript). The last inputbox is for the client seed.
4.) The player then clicks on one of the two buttons and the bet is sent to the server. The data sent to the server is "heads/tails" choice, the bet amount, and the number from the second inputbox (client seed).
5.) The server then reveals the nonce, the server number and calculates the result of the bet together with the player input. This calculation can also be done by the player to confirm that everything went fair and that the proper hash was sent originally.
The result is calculated as follows: (server number + client seed) divided by 99 and using the remainder as result (note: integer division).
If this resulting number is 1-49 this means "heads", if 50-98 it means "tails" and a 0 means "edge". If the player picked correctly the payout is made.
Note that a page with a certain hash will timeout after 3 minutes (to avoid giving a long time to calculates hashes).
What do you think? Is this fair?
(note: small correction for step 5)
