> ## Documentation Index > Fetch the complete documentation index at: https://docs.horse.fun/llms.txt > Use this file to discover all available pages before exploring further. # VRF Technical Deep Dive > Mathematical foundations and cryptographic proofs ## Verifiable Random Functions VRF provides cryptographic guarantees: 1. **Uniqueness:** Input → Unique output 2. **Pseudorandomness:** Output indistinguishable from random 3. **Verifiability:** Proof allows anyone to verify correctness *** ## Plackett-Luce Sampling The full finishing order is produced by **sequential weighted sampling without replacement**, using only integer arithmetic so it is deterministic and verifiable on-chain. ### Algorithm Let the (already permuted) winning weights be in basis points, $w_i \in \mathbb{Z}_{\geq 0}$ with $\sum_{i=0}^{8} w_i = 10{,}000$. Starting from the full set $R = \{0, 1, \ldots, 8\}$, fill finishing positions $k = 0, 1, \ldots, 8$ in order: ``` for k from 0 to 8: r_k = SHA256(seed || "ranking" || k)[0:16] // little-endian u128 W = sum of weights of horses still in R t = r_k mod W // target in [0, W) walk horses j in R, subtracting w_j from t until t < w_j assign horse j to finishing position k, remove j from R ``` Position 0 is the winner (1st place), position 1 is 2nd, position 2 is 3rd; the same procedure yields the full ordering. If $W = 0$ at some step (degenerate all-zero weights), the horse is chosen uniformly among those remaining. ### Proof of Correctness This is an exact sampler for the **Plackett-Luce** distribution. The first horse is drawn with probability proportional to its weight: $$ \Pr(i \text{ finishes 1st}) = \frac{w_i}{\sum_j w_j} = p_i $$ Conditioned on the horses already placed, each subsequent horse is drawn proportionally to the remaining weights, so the full finishing order $a = (a_0, \ldots, a_8)$ has probability: $$ \Pr(a) = \prod_{k=0}^{8} \frac{w_{a_k}}{\sum_{j \geq k} w_{a_j}} $$ **QED:** the marginal winning probability of each horse is exactly $p_i$, and higher-weight horses are more likely both to win and to place. *** ## Fisher-Yates Shuffle ### Algorithm ``` for i from n down to 2: j = random_int(1, i) // derived from VRF seed swap(array[i], array[j]) ``` ### Properties * **Uniform:** All permutations equally likely * **Deterministic:** Same seed → same permutation * **Verifiable:** Anyone can recompute *** ## Jackpot Trigger Uniformity ### Hash-Based Derivation ``` seed_normal = SHA256(VRF_seed || "normal_jackpot") trigger = (seed_normal mod 125) == 0 // Normal: 1/125 seed_super = SHA256(VRF_seed || "super_jackpot") trigger = (seed_super mod 12500) == 0 // Super: 1/12500 ``` ### Uniformity Proof SHA256 output is uniformly distributed over $\{0,1\}^{256}$. For modulo reduction: $$ \Pr(\text{hash mod } n = k) = \frac{1}{n} $$ Bias $\epsilon = \frac{n}{2^{256}} < 10^{-70}$ for $n \in \{125, 12500\}$ (negligible) **QED:** Trigger probability is exactly 1/n *** ## Liveness and Genesis ### Oracle Liveness If no valid VRF proof arrives within a timeout $T_{\text{VRF}}$ after entries close, the protocol **re-requests** randomness and the race stays pending — resolution is simply late. The per-attempt timeout is deliberately long (minutes, not seconds): each new request draws a fresh seed, so rapid retries would let an adversary capable of briefly censoring fulfillment transactions suppress unfavorable outcomes and "re-roll" the race. A slow retry cadence makes such censorship impractically expensive. ### Permanent Oracle Failure Retries continue indefinitely — there is **no in-contract cancellation path**. If the oracle provider discontinued service entirely, resolution is restored through the protocol's standard upgrade path: the multi-sig upgrade authority migrates the program to an alternative VRF provider, and pending races then resolve with fresh verifiable randomness. This adds no trust beyond what upgrades already require. The protocol **never substitutes a deterministic fallback** (blockhash, fixed seed) for missing oracle output: a known fallback seed would make the emergency outcome computable in advance — converting a liveness failure into an integrity failure. ### Chain Continuity A pending race consumes nothing: the following race derives its track and permutation from the **most recent fulfilled seed**, and the randomness chain resumes at the next fulfillment. Track and permutation are public during the entry phase by design, so reusing the latest fulfilled seed for setup leaks no outcome-relevant information — winners and jackpot triggers always come from the fresh seed drawn at each race's own entry close. ### Genesis The first race has no predecessor to inherit a seed from. At initialization, a dedicated VRF request is made **before** race 1 opens for entries; its output serves as $\text{seed}_0$, so even the first track selection and permutation are oracle-derived rather than operator-chosen. *** ## Security Assumptions 1. **VRF Security:** Switchboard VRF construction is secure 2. **SHA256 Collision Resistance:** Computationally infeasible 3. **Discrete Log:** Breaking oracle keys infeasible All are standard cryptographic assumptions. *** ## Next Steps User-friendly VRF explanation Complete security analysis Implementation details Full technical whitepaper