Skip to main content

​
Verifiable Random Functions

VRF provides cryptographic guarantees:
  1. Uniqueness: Input → Unique output
  2. Pseudorandomness: Output indistinguishable from random
  3. Verifiability: Proof allows anyone to verify correctness

​
Plackett-Luce Sampling

The full finishing order is produced by sequential weighted sampling without replacement, using only integer arithmetic so it is deterministic and verifiable on-chain.

​
Algorithm

Let the (already permuted) winning weights be in basis points, wi∈Z≥0w_i \in \mathbb{Z}_{\geq 0} with ∑i=08wi=10,000\sum_{i=0}^{8} w_i = 10{,}000. Starting from the full set R={0,1,…,8}R = \{0, 1, \ldots, 8\}, fill finishing positions k=0,1,…,8k = 0, 1, \ldots, 8 in order: 
for k from 0 to 8:
    r_k = SHA256(seed || "ranking" || k)[0:16]   // little-endian u128
    W   = sum of weights of horses still in R
    t   = r_k mod W                              // target in [0, W)
    walk horses j in R, subtracting w_j from t until t < w_j
    assign horse j to finishing position k, remove j from R
Position 0 is the winner (1st place), position 1 is 2nd, position 2 is 3rd; the same procedure yields the full ordering. If W=0W = 0 at some step (degenerate all-zero weights), the horse is chosen uniformly among those remaining.

​
Proof of Correctness

This is an exact sampler for the Plackett-Luce distribution. The first horse is drawn with probability proportional to its weight: Pr⁡(i finishes 1st)=wi∑jwj=pi\Pr(i \text{ finishes 1st}) = \frac{w_i}{\sum_j w_j} = p_i Conditioned on the horses already placed, each subsequent horse is drawn proportionally to the remaining weights, so the full finishing order a=(a0,…,a8)a = (a_0, \ldots, a_8) has probability: Pr⁡(a)=∏k=08wak∑j≥kwaj\Pr(a) = \prod_{k=0}^{8} \frac{w_{a_k}}{\sum_{j \geq k} w_{a_j}} QED: the marginal winning probability of each horse is exactly pip_i, and higher-weight horses are more likely both to win and to place.

​
Fisher-Yates Shuffle

​
Algorithm

for i from n down to 2:
    j = random_int(1, i)  // derived from VRF seed
    swap(array[i], array[j])

​
Properties

  • Uniform: All permutations equally likely
  • Deterministic: Same seed → same permutation
  • Verifiable: Anyone can recompute

​
Jackpot Trigger Uniformity

​
Hash-Based Derivation

seed_normal = SHA256(VRF_seed || "normal_jackpot")
trigger = (seed_normal mod 125) == 0      // Normal: 1/125

seed_super  = SHA256(VRF_seed || "super_jackpot")
trigger = (seed_super mod 12500) == 0      // Super: 1/12500

​
Uniformity Proof

SHA256 output is uniformly distributed over {0,1}256\{0,1\}^{256}. For modulo reduction: Pr⁡(hash mod n=k)=1n\Pr(\text{hash mod } n = k) = \frac{1}{n} Bias ϵ=n2256<10−70\epsilon = \frac{n}{2^{256}} < 10^{-70} for n∈{125,12500}n \in \{125, 12500\} (negligible) QED: Trigger probability is exactly 1/n

​
Liveness and Genesis

​
Oracle Liveness

If no valid VRF proof arrives within a timeout TVRFT_{\text{VRF}} after entries close, the protocol re-requests randomness and the race stays pending — resolution is simply late. The per-attempt timeout is deliberately long (minutes, not seconds): each new request draws a fresh seed, so rapid retries would let an adversary capable of briefly censoring fulfillment transactions suppress unfavorable outcomes and “re-roll” the race. A slow retry cadence makes such censorship impractically expensive.

​
Permanent Oracle Failure

Retries continue indefinitely — there is no in-contract cancellation path. If the oracle provider discontinued service entirely, resolution is restored through the protocol’s standard upgrade path: the multi-sig upgrade authority migrates the program to an alternative VRF provider, and pending races then resolve with fresh verifiable randomness. This adds no trust beyond what upgrades already require. The protocol never substitutes a deterministic fallback (blockhash, fixed seed) for missing oracle output: a known fallback seed would make the emergency outcome computable in advance — converting a liveness failure into an integrity failure.

​
Chain Continuity

A pending race consumes nothing: the following race derives its track and permutation from the most recent fulfilled seed, and the randomness chain resumes at the next fulfillment. Track and permutation are public during the entry phase by design, so reusing the latest fulfilled seed for setup leaks no outcome-relevant information — winners and jackpot triggers always come from the fresh seed drawn at each race’s own entry close.

​
Genesis

The first race has no predecessor to inherit a seed from. At initialization, a dedicated VRF request is made before race 1 opens for entries; its output serves as seed0\text{seed}_0, so even the first track selection and permutation are oracle-derived rather than operator-chosen.

​
Security Assumptions

  1. VRF Security: Switchboard VRF construction is secure
  2. SHA256 Collision Resistance: Computationally infeasible
  3. Discrete Log: Breaking oracle keys infeasible
All are standard cryptographic assumptions.

​
Next Steps

Verifiable Randomness

User-friendly VRF explanation

Security

Complete security analysis

Smart Contracts

Implementation details

Whitepaper

Full technical whitepaper