Topic: Lottery guy bets entire BTC fortune and ... loses? :) (Read 6621 times)

Clearly proven that it's a flaw, yes, that it will be a problem no. In terms of the chain of trust it is most definitely a gap, obviously an escrow service or anyone lese is only as good as the reputation they have, an established escrow service should have more trust because it's what they do.

Because it has not been clearly proven at all, and saying it has been while good nlp does not make it so.

Any escrow service could also do exactly the same "trick" (running with the money) and even additionally has to trust the operator of bitlotto that he provides correct data in the first place.

Even if someone (like the operator) writes an Open Source program and publishes that, he chould still run a modified version in secret, and I'm not sure how feasible/possible it is to proove via a remte connection that you are ONLY running a certain piece of code. In the end you have to trust someone, if you hand over money and the approach of extending that trust over not too many people is a good one in my opinion. If you don't agree, you can do something else as well than play a lottery!

Cause I'm nice?  Yes, I agree escrow is a small flaw. That doesn't make it so I can manipulate who wins though. I also explain that escrow just moves the trust and adds another person that needs to be trusted. No matter what, someone has to be trusted. With time I hope to prove that it can be me. Whoever has access to the money can be a flight risk. I hope that earlier in this thread I explained well why I would be crazy to do that and because of that I intend on operating an honest lottery as long as people play. 

How can everyone here continue to side with BitLotto? It's been clearly proven that there is a flaw without an escrow service.

I think you are delusional about most people agreeing that he lost.  I know I for one don't agree with that. 

I also think your reputation has become  more at at stake here then his.

LOL. Thanks, that kind of cheered me up! Good luck!!! I just wish is was easier to explain BitLotto's unique features. 

After reading and enjoying this thread, I'm off to bitlotto.com to buy some lotto tickets.

this is cool

Me buying tickets is only a problem *if* I'm planing on running one day. I get that. You pretty much say that all this *cheating* depends on me planning on running. I get that. BUT it would be noticed when I do!

*I'd love to do escrow* I really would. I just don't know how I'd set it up!!
How?

Someone somewhere has to hit PAY! That person could be a player themselves. That person could be someone who just lost a lot of money. Who would we pick? I think someone said Gavin? Well, perhaps he's not interested. I wouldn't want it to be an American (No offense) It's just that the laws are a big jumble of white,grey,and black. Almost everyone is a criminal in some way. We could think it's safe having someone hold it only to have another big lottery company complain because they don't want to compete, create a panic in the media, and money seized? Now it's lost.
Is money held in escrow in the USA more risky? What country then? Perhaps it's safer having an anonymous person having it? I only have access to a small amount right now. I'm still building trust. You say I could be waiting for a big jackpot to run away with. I think that would be STUPID of me because:
-I'd for sure have committed a crime - theft
-I'd piss off thousands of thousands of highly technical people -I'd be caught eventually -Having Anonymous after me for example would make my life a living hell
-I'd be miserable always wondering if I'd get caught
-The 1% is the key: I can make a comparatively small profit honestly, no worries, and with time I can make money off that 1%, I don't NEED to steal it (I'm even going to teach my partner how to pay the winner if I die!)
-It is in my best interest to operate a legitimate lottery

UNTIL I run with the money, all the draws can be demonstrated to be sound. Sure my *intent* could be in doubt BUT each draw can be proven that the rightful person got the winnings.

IF someone can show how I can do escrow safely that doesn't have the risk I mentioned I'll do it. I really will.

Step 6 is broken easily by the NOT indefinite amount of Bitcoins in the system.
The maximum amount of Bitcoins the lottery could hold are "total current Bitcoins - my Bitcoins", assuming that the lottery also runs the entire bitcoin system.

The worst chances of winning therefore are "My bitcoins/total bitcoins".

As soon as "My bitcoins" grows large enough, the lottery cannot any longer outbid me 1000-fold (or whatever is considered "virtually certain"). Assuming Satshi has 10% of all Bitcoins in posession and breach of trust (just taking the money and running away) is not cheating, but a different "attack", the maximum amount the lottery could bid against him would be 90% of all Bitcoins.

Long story short:
It is not possible for the lottery owner for arbitrary amounts to gain "virtual certainty" of winning. This means, he must impose maximum amounts that players are allowed to play each round to make sure he is always _able_ to overbid. Also just 1:100 or 1:1000 might not be enough, depending on the intended lifespan of such an endeavour, plus it would give less interest the better chances you want to have (if you overbid by 1000 each time, you just have 0.1% interest each round)

Well, the "build trust and then run away at some point" can be applied too.
I agree, the operator cannot prove that he won't run with the money. In this sense it's not provably honest. Neither is a third party escrow unfortunately.

The point of dissension I think is step 11.
The premise to this is that no player will prevent him.
As a player, I can make sure the operator does not execute step 11, because I can myself purchase enough tickets to remove this virtual certainty.
(Indeed, I can purchase enough tickets to secure the virtual certainty in my favor).

Admittedly, this may end in an arms race to secure the odds, (and we're back at step 4: users have a finite amount of bitcoins to play with).
It's not a proof of honesty per se obviously. But it states the existence of a method for any player to be sure that he is not tricked with the technique you detailed.

tldr; I would like to see a "provably honest" lottery, and provide formal step-by-step proof that a lottery without a trusted escrow is not provably honest.


First, realize that this whole thread started with a comment by Joan that said "Lotteries need to be provably honest."  Keep in mind, I didn't start this thread, despite the appearance to the contrary.  I made a comment in response to Joan in another thread, and apparently an administrator thought it was interesting enough (or off-topic enough) to merit its own thread, and moved in into it's own thread, making my message the lead comment.  The original topic was "Re: Bitcoin7 a new exchange" as you can see in some of the early messages starting with message #2.  In an effort to have it make sense on the forum (since the admin forced me into a position of "thread first post" with a message that didn't make much sense as the first post, and made it look like I made no sense), I changed the topic and the intro to the first message, because having it called "Bitcoin7" wasn't logical.  If that appears "dishonest", tell me what you want it to say.  I have already edited it twice in an effort to have it make sense to the casual reader, and in an effort to appease the user Bitlotto's claims that I was being dishonest. I can't guess at what you want.  I have never accused Bitlotto of being dishonest (even though he accused me of that), in neither the current thread, nor the pre-edited post.

Second, I have no malice toward bitlotto (the user or the service).  My goal in this thread is simple:  figure out a way to create "provably honest" lotteries, and determine whether there is one already.  The Bitlotto service may be completely honest (and I've stated already that I believe that it likely is), but the challenge of this thread is whether it is provably honest, as stated in the very first message.  It got more interesting when Bitlotto, the user, made a claim that his service is "cheat-proof".  Remember, the goal is to have "provably honest" lotteries, and so if this claim is true, he may have one.  But I don't think so.

I believe Bitlotto wants his service to be provably honest, and I made a suggestion as to why I don't think it's cheat-proof, and how it could be improved with a trusted escrow.

Step By Step Proof

So, as a proof that Bitlotto, the service, is not "cheat-proof" without a trusted escrow, here's excruciating step-by-step proof (sorry so long).  If you disagree, please tell me which particular step in my logic is flawed.

Step 1.  In order for a lottery to be provably honest, the participant's true expected payout must be equal to the published expected payout, which is published by the lottery operator.

Step 2.  It is impossible to tell whether a lottery participant is affiliated with the lottery (either the lottery operator or a shill).  I believe this is self-evident, and user Bitlotto also made the claim that the participants are anonymous.  Even if all participants stepped forward and individually identified themselves, it's impossible to prove that they are not affiliated with the lottery operator.  (It's often impossible to "prove a negative".)

Step 3.  The operator can purchase tickets to his own lottery without being detected.  (Thanks to Step 2)

Step 4.  There is a concept of "finite".  Users have finite lifespans.  Operators have finite lifespans.  Companies have finite lifespans.

Step 5.  There is a concept of "virtual certainty".  (Any supporter of Bitcoin should understand this concept, as the whole Bitcoin system is based on virtual certainty principles, from the confirmation process, to the effort to create unique Bitcoin Addresses.)  There are events whose probability is so high that it is "virtually certain" that they will happen.  And within the context of a finite number of trials, they will almost certainly happen every time.

Step 6.  It is possible for an operator to purchase tickets to their own lottery with virtual certainty of a win.  This step is perhaps best demonstrated with an example.  Using extremes, it's easy to see that this is true.  Let's say Satoshi holds 600,000 Bitcoins, and he holds a random monthly lottery whereby he convinces a single user to wager .01 Bitcoin, with the potential payoff of 600,000 Bitcoins.  Satoshi holds 60 Million times as many entries as the user.  While all lotteries are long shots, you can predict with virtual certainty who will win this lottery every month during Satoshi's finite lifetime: Satoshi.  Note, it's important also to note that a VERY small change from approximately 1 in 60 Million to 0 in 60 Million is the difference between honest and dishonest; Satoshi purchasing that many tickets in his own lottery does not in itself make the lottery dishonest.

Step 7.  It is possible to "launder" Bitcoins such that you can hide your identity and pay yourself, without everyone being able to detect who had the original Bitcoins.  (No need to read this whole step, unless you don't believe that it's possible to launder Bitcoins without "everyone noticing".)  Once again, easy to demonstrate with an extreme example:  Let's say you have 1 Bitcoin that you are trying to launder.  You can transmit 1000 Bitcoins to an account, with that 1 Bitcoin bundled as part of the transaction.  And then transmit 1000 Bitcoins to 1000 separate accounts, and the particular "1" Bitcoin is effectively lost.  No one can say with certainty which of the 1000 accounts holds the "dirty" one (in fact, every accusation is likely to be a false accusation as, in this example, 999 out of 1000 accounts are clean.  If you don't think that's enough laundering, run it through the same process 1000 times).  There are a number of well-documented ways to move money around to launder it.  You may even be able to set up an anonymous Mt. Gox account using Tor, transfer the 1 Bitcoin to the account, wait a week, and then make a 1 Bitcoin withdrawal.  During that week, "your" 1 Bitcoin will likely have been bundled with others and sold, and the one that you withdraw would be clean.  Not everyone would notice that you did that.  In fact, everyone would NOT know - only someone with access to the Mt. Gox logs would be able to tell what the "new coin" was, and if he were a co-conspirator, then it'd be possible that no one else would know.  Laundering money is possible with Bitcoin (even though laundering large amounts is difficult, it is still quite possible to launder money so that not "everyone notices" that the lottery operator is paying himself).

Step 8.  A lottery operator can shut down his lottery and take all the bets without paying off a winner, effectively stealing money from lottery participants.

Step 9.  A lottery operator can launder stolen money. (see step 7)

Step 10.  If a lottery operator's mode of operation is that under certain circumstances (of even miniscule probability), he will steal money from the lottery participants, and this plan to steal is not published in the lottery rules, then the user's true expected payout is less than the published expected payout, and therefore, by definition in step 1, the lottery is not "provably honest".  (Note, this is regardless of whether the circumstances which trigger the planned theft ever occur in finite time.)

Step 11.  It is possible for a lottery operator to, unbeknownst to the participants, purchase tickets to his own lottery, to create virtual certainty that he will win (Step 6), and have an unpublished fallback plan (which is virtually certain to never have to be executed), to shut down and steal the jackpot, and launder the money (Step 10). 

Step 12.  Lotteries that do not employ trusted escrow services cannot be "provably honest", because such lotteries can have a mode of operation whereby they steal from the participants under certain circumstances (as mentioned in Steps 10 and 11).

Q.E.D.


"Virtual Certainty" means with an extremely high probability, and you can take all of the above steps and apply them with lower probabilities within the context of finite lifespans.  You may be questioning the relevance of this proof (with extreme examples) in the context of one like Bitlotto.

The simple, very practical example that I already gave is that an unscrupulous lottery operator can set up a lottery whereby he runs a monthly lottery selling 1 Bitcoin worth of legitimate tickets and buys 130 himself, with the plan to run off with the money if he fails to win.  He will make approximately 10% annual return on his "investment", and his lottery will have an expected lifespan of ten years before he runs out of luck.  Further, if he pumps his gains back into his lottery, he can extend the expected lifespan of his ruse.  And if his monthly execution is that he buys all of his tickets on the last day, then he ties up his money for very little time (12 days a year), while making 10% annual return on his money.  Over ten years, he never makes a legitimate payout, and every monthly "drawing" is a scam, despite appearances to the contrary.  Low risk, minimal investment, reasonable payback.  You can alter the parameters to achieve the risk/reward that you find desirable, but I contend that an investment returning 10% per year with very little risk and the opportunity to make the risk even less in greater years is an attractive investment. 

I also asked the simple question as to how we could prove that Bitlotto DIDN'T do that already, to which all I got back was that the burden of proof is on me, to prove that he did.  No, that's not my obligation.  I'm not set out to prove that BitLotto is a scam, I'm trying to prove, and feel I have successfully proven, that it's not "provably honest".  And so it's not my obligation to prove that he did cheat; It's my obligation to prove that he could have cheated (which I feel I did in earlier posts, and just did again in this post), and thus far no one has been able to find legitimate fault with my proof.

Changing the subject away from a particular lottery and speaking generally: to me, it's obvious that a lottery that plans to steal the money under certain random events, without disclosing this plan in the lottery rules, is dishonest, regardless of whether that random event ever occurs.  If the Satoshi lottery mentioned above in Step 6 had the published plan of "your odds of a payout are 1 in 60 Million", but with a real plan of "if that 1 in 60 Million chance hits, I'm not going to pay off anyway", then it would be dishonest, regardless of whether the one-in-sixty-million long-shot event ever occurred.  And that long-shot event will likely never occur within the span of Satoshi's lifetime, yet such a lottery is dishonest.

All of this proves that any claim of "It's cheat proof" is false.  And that it is possible for a lottery operator to "pay [him]self without everyone noticing".  These were the exact challenges that were put forth in thread message #4. 

Unless a Lottery operator can prove that the published expected payout is accurate (and that he has no plans to run off with the money), he cannot have a provably honest lottery.  By instituting a trusted escrow, it's possible to reduce the likelihood of an operator being able to execute a plan to run off with the money.

Why am I trying so hard?  Because I want a provably honest lottery.  And to me it seems pretty clear that this is not provably honest (and that it's a hard problem to solve) and I can't believe that I'm having a hard time convincing certain other people to understand what I think is obvious.  And if I am wrong, I want to know exactly where I am wrong, because I am not seeing it, after reading numerous futile messages to enlighten me.


P.S. I'm not sure what the reluctance is to running a lottery through a trusted escrow.  Is it the cost?


:: dead horse, beaten beyond recognition.

Now if only he would undo his commentary he added after on the first post.
Many will just read the first post and move on. Dang. Oh well.

Meni Rosenfeld is correct.  No matter how many tickets the operator buys, the customers don't lose, and the operator doesn't gain.

The scenarios Meni has written are sufficient to show that the operator doesn't gain.  However, to flog this dead horse, here's another pair of scenarios:

Scenario C: One customer buys a single ticket.
The operator collects a 0.01 BTC (1% * 1 BTC) fee.
The customer paid 1 BTC and will automatically win 0.99 BTC, so his expected gain from the bet is -0.01 BTC.

Scenario D: One customer buys a single ticket, and the operator buys 999 tickets for himself.
The operator paid 999 BTC. He has 99.9% chance of winning the entire 1,000 BTC, and a 0.1% chance of getting only a 10 BTC (1% * 1,000 BTC) fee. Expected gain is 999 BTC (99.9% * 1,000 BTC) + 0.01 BTC (0.1% * 10 BTC ) - 999 BTC = 0.01 BTC, same as before.  The customer paid 1 BTC and will on average gain 0.99 BTC (0.1% * 990 BTC) - 1 BTC = -0.01 BTC, same as before.

Regardless of how many lotto tickets the operator buys, his gain is the same, 1% of the customer's bet.  Regardless of how many lotto tickets a customer buys, his loss ratio is the same, the 1% fee which goes to the operator.


The method currently used by bitlotto, as described in the quote below:


can not be gamed by Jerfelix's method, regardless of how many tickets the operator buys.

This is not a matter of opinion, anyone with a correct understanding of statistics can follow the reasoning to its inevitable conclusion.


Therefore, your dilemma is solved.  Bitlotto runs a betting site, he won this very public bet in a forum and you lost.  Since he won, there is nothing to pay up, so there is no reason for distrust.

I misread your post and had me thinking I shouldn't announce the win or something...oops. I got ya! 

No, I know you can't. I hope the following clears up what I meant.

Don't worry: I can't
I don't know who plays or who wins. Only if the person announces they won do I know. So far one person has remained anonymous while the other created a new account to announce their win so I don't really know who they are either. If you win it's up to you.

Yeah, I meant I was just noting that I didn't know you couldn't just transfer in one transaction.

Announce that I won the lottery.

Thanks. Next time I update the site I'll mention that a-f are digits.



I think you mis understand. The BTC was in the BitLotto wallet. I just send one payment. It did all the moving of coins. It doesn't combine the coins before moving to the next person. It happens all the time when sending BTC. I say to it send 100 it then sends 100 but looking in blockexplorer it sent 1 but 100 times. It's ok, doesn't really change anything.

Announce what?