I don't think the issue here is the system's provable fairness, although I haven't verified it.
Their provably fair is actually not provably fair. The bust points are provably predetermined, but there's nothing that requires them to have a degree of randomness or keep true to their 2% edge. This is how the system works:
(screenshot)The results of the bets are not generated in a manner that provides proof to the house edge. The results are arbitrary and the hashes show the results of the precalculated result.
NLNico (arguably one of the top minds in the provably fair gambling space) agrees:
Added negative trust.
People should realize that their "provably fair" implementation is already not provably fair anyway. They could literally show 10000s of hashes where the string is "Lose:......" and claim it's provably fair because the hash is the same. That is not how provably fair works.
Somehow, with such a crappy bad non-"provably fair" implementation, they still managed to cheat it extra - by changing the hash. That is like almost impressive. <- unrelated to FortuneJack situation
Please ignore such sites.
If I was FortuneJack and a whale started playing, I am able to give them only 10 rounds that are fair, and feed them hashes with low bust values after the 10. A big whale,
baaaitcoin played 884 rounds on bustabit (with that account. IIRC they made multiple), and bet on average 10.85
BTC per bet. If they played on FortuneJack, FJ could have manipulated all of the bust points after the first 10 rounds to have lower bust points than they should, causing baaaitcoin to go bankrupt very quickly. Something like this could have been given:
148852:1.21:cf13f713-8d0b-4268-8c5e-dc7f088a5540 // should have been 5.01, modified to 1.21
148851:1.17:4e7da20e-07e7-47a6-816d-3b021f3c3dd5 // should have been 41.88, modified to 1.17
148850:1.37:f8c08863-c87d-4df6-961d-5d29d21aa6b0 // should have been 4.47, modified to 1.37
148849:1.00:99920d7f-b197-4740-9291-58fd8128eb2b // should have been 1.87, modified to 1.00
148848:1.25:aa5f0f49-c16a-491c-a985-a297cbad1bde
148847:1.37:1a2396eb-fe8b-499e-8492-7f42c3b5a294
148846:1.34:1c87a433-0153-44a3-8f62-7774097c1c4b
If baaaitcoin was aiming for multipliers above 1.38, that's an easy 70
BTC in profit for FortuneJack. And the best part is, the games would verify as provably fair. I don't know if FortuneJack did this to cheat anyone, and I can't download the ~148k bust points from games played to see if the bust points hover near a 2% house edge. I don't think they cheated anyone (most likely incompetence), but
any system that allows a casino to undetectably cheat is not provably fair.
2. There is no history for prior games available as far as I know. The provably fair list given only shows the last 19 game results. No available prior bust history combined with no proof of random bust points means that it is impossible for the community to verify that the bust points deviate around the x1.98 bust point (based off of 2% house edge). For all we know, the game code could be set to generate bust points with an average at x1.8, which would significantly increase the house edge.
There is no way for the player to even attempt the verify that the game is fair.3. Even if the game history is provided, and the bust points deviate from x1.98, FortuneJack could simply fill in some very high bust points when no one is playing the game. The chance that someone would join the game and play in 10 rounds is low, and the chance that the player who joined would be chasing a very high multiplier is even lower. This could allow them to have the bust points deviate from a higher bust point when no one is playing, and a lower bust point when someone is playing.
This gives them fully undetectable "provably fair" where they can easily cheat.4. Let's pretend they do have a legitimate bust value generation in the background, and can provide a hash chain + seed that gives all of the bust points. Let's also pretend that we have access to the full game history that has no chance of being modified. There is still an issue with this: they did not post a hash chain publicly and find the seed in a fair way. They can easily manipulate this to give themselves a much higher edge.
RHavar explains how in this post. This leaves them with no way of proving that all bust points were generated fairly in the backend.However, it's much more likely that they're using a Math.random(); in the backend which they can freely modify.
5. Game hashes are only provided 10 games in advance. This makes it hard for gamblers to verify their bets, as every time, a new game hash is given, they need to write it down somewhere to verify later. This is incredibly tedious to do (especially if you make hundreds of bets) and more likely than not, players won't be doing this and just trusting that FortuneJack won't modify the hash. Knowing this, FortuneJack can modify hashes with a very low risk of detection, and even if they were detected, it's the player's voice against FortuneJack's. (their page is set up in a way that can't be archived). Ironically, RollinCoin had a better system than this. Furthermore, having no past history further amplifies this problem. A player needs to verify each game before 19 more games has passed, as they can't check the data for older games.
FortuneJack makes it very difficult and annoying for a player to reasonably verify their games. Provably fair systems should be easy and intuitive to use, as players would be heavily discouraged from verifying bets otherwise.
If FortuneJack did swap hashes and a player came here to complain, you can bet that a bunch of people who are conveniently wearing FortuneJack signatures will come defend them, using arguments like "FortuneJack is an established and old casino, why would they cheat you? Go away." or "FortuneJack is trustworthy, they paid me for my signature! Stop spreading FUD."
FortuneJack can swap game hashes with very low risk of being detected. Even if they were detected, it's the player(s) word against FortuneJack and if that player had no reputation somewhere (ie bitcointalk), people would quickly reject the player(s) claims.
SummaryThere is no proof that bust points are generated to only have a 2% house edge. FortuneJack can very easily manipulate the bust points for each round, if they do it 10 rounds prior and there is no way to detect this. This essentially allows them to cheat, with 'provably fair' still showing the game was fair. NLNico, owner of
DiceSites.com and one of the most well known people in the provably fair space suggests to "ignore such sites."
They should fix this by copying a working provably fair system, like the one bustabit uses.
TLDR: Read bolded lines
edit: fixed incorrect explanation of bustabit's system
edit2: added fifth point
