I have raised this with Dooglus over a week ago, we discussed solutions but he has decided the site will not change.
The problemThe client side key is generated by the server initially and has no security so it can be changed at any time
BackgroundThere are three parts to generating a fair bet:
- Server Key - given to the user as a hash
- Client Key - known by the user (and should be generated by the user)
- Bet number
The time and size of a bet have nothing to do with the result.
How can this be abusedThe nature of Just-Dice rolls are that you bet high or low in a 0-100, if the client and server key are generated by the server they can pre-prepare client-server keys that will result in rolls in their favor.
for example they can generate millions of sets of hashs until the results:
1) are generally 10-90 so that people will not get the rare 10x payout rolls (less than 10 or greater than 90)
2) have long streaks above or below 50 to send martingalers bust
So use your imagination, they can dictate the roll results
The technical detailsThe code is available here:
https://just-dice.com/javascripts/dice.jsA beautified copy:
http://pastebin.com/CatuARX2The Server and Client keys can be changed at any time by the server, here is the corresponding code:
socket.on("shash", function(data) {
$("#shash").html(data)
});
socket.on("seed", function(data) {
$("#seed").html(data)
});The only protection is if the user writes down both keys and verify their bets every 100 rolls, after that your bets a no longer visible
When you load the site, the client key is provided by the server, this is not a problem for returning users, but first time visitors should have their own java-script engine generating a client key, here is the code:
socket.on("init", function(data) {
... other code ...
$("#shash").html(data.shash);
$("#nonce").html(data.nonce);
$("#seed").html(data.seed);It is possible to use the randomize function when you first enter the site, but I do not believe many users do this.
CaveatI am not accusing the site of rigging rolls, I am just saying that it is possible.
