I have some concerns about the provably fair system. Specifically, I believe that it is possible for a malicious game operator to always purchase the winning ticket, thereby cheating the players:
- The game operator can join the game at the last possible moment and guarantee that no other players are able to join after that.
- Given any game state, the game operator can calculate the winning ticket. Aside from the server seed and the client seed–which are predetermined–the total number of tickets determines the winning ticket (relevant code).
- The game operator can find a number of tickets he has to purchase in order to receive the winning ticket and then purchase that number of tickets.
- Consequently the game operator is guaranteed to win that game himself.