Check that a round's result was decided before you bet and hasn't been changed since. Everything runs in your browser.
Checking the secret, outcome and payout.
Checking the round's inclusion in the batch.
Polygon Amoy is a test network. This checks this round only; it does not certify the game's RTP.
Row 1 is at the bottom. ✓ safe pick · ✕ trap · ✗ the pick that lost.
Lanes run left to right. ✓ crossed · ✕ trap · ✗ where it hit; the stop lane is outlined.
Line: the multiplier over time. Dashed line: the crash point. Dot: where the round ended (green: cashed out).
Posts run left to right. ✓ swiped · ✕ bust; the post where the round stopped is outlined.
Each message shows its roll; red means it would ghost at that tone. The tone you sent is outlined (✓ reply, ✗ ghosted).
| Bet | Pays | Returns | RTP |
|---|
The number under each card is its place in the shoe. The headline RTP is the lowest bet's (the tie); each bet's RTP is listed below.
Your marks are outlined. ● mole · ✓ hit.
At each row the ball goes left (L) or right (R); bucket 0 is far left. Bucket multipliers from the published profile compiled into this page.
Roll X is U(10000) shown as X ÷ 100. Under wins below the threshold; over wins at or above it. The multiplier is from the published profile compiled into this page.
Amounts are in minor units; gross return includes returned stakes. All seven cards, including burns, are regenerated from the 416-card shoe. Aces are high; a second tie wins the war.
Amounts are in minor units; gross return includes returned stakes. Cards are drawn with replacement from one stream. Replay checks insurance, peek, split, double and dealer stand on soft 17.
Each lane wins when its independent U(411) draw is below 200. Two wins pay 1.65×; three pay 3.10×. Lineups are cosmetic.
The opponent's gesture is U(3) from the revealed secret. A draw returns your stake. The multiplier is from the published profile compiled into this page.
The result is X = U(2^52) turned into a multiplier; it wins iff it reaches your target, and a win pays the target. The scale is clipped at 1000.00×; the exact result is printed in the caption.
Your picks are outlined, the drawn numbers are filled and numbered in draw order, and a pick that was drawn is a hit. The multiplier is from the published table compiled into this page.
All ten coins are drawn when the round opens; each shows its flip (H or T). Your calls are marked ✓ (right) or ✗ (wrong, ending the round). The coin where the round stopped is outlined; later coins were never flipped.
The dealt cards in order, with each guess between its two cards: ↑ higher or ↓ lower with its chance (winning cards ÷ cards left), ✓ survived or ✗ lost. An equal rank loses. The card the round stopped on is outlined; cards after it were dealt but never reached.
Segment 1 is at the top, then clockwise; the landed segment is outlined. Ring layout from the published profile compiled into this page.
Browser self-test failed; browser results withheld. The rows below show the RGS server's results only.
Your browser recomputed this round from its canonical receipt and the revealed server secret. The secret matches the commitment recorded in the receipt, and the recorded outcome and payout follow exactly from them. This proves the receipt reproduces the recorded result. It does not prove when the commitment was made: see “Commitment issued” under the receipt.
Your browser hashed the receipt and folded the Merkle proof up to the batch root. This proves the receipt is included in that batch. It does not prove that the batch contains every round.
Your browser asked a public Polygon Amoy node for this batch in the RootRegistry contract. The node returned the same root and leaf count. This proves the batch root was published on a public blockchain at block , so it cannot be changed later without detection.
RGS server verdict
The server's own recomputation (overall_valid). It never includes anchoring.
—————————————————The revealed secret hashes to the commitment:
HMAC-SHA256 over the derivation input v1 (shown assembled) gives derived_random:
Mines placement and payouts: see docs/protocol.md § Mines math 1.0.0 and § Mines RTP profiles. The payout is floor(bet × num × Π(25 − i) ÷ (den × Π(25 − m − i))) for the profile's num/den shown above.
Tower: one U(columns) trap per row from rgs-tower-stream-v1. Chicken: U(5) ≥ 4 marks a trap lane from rgs-chicken-stream-v1. Your browser validates the complete action path and recomputes the profile's floored payout, then compares it with the receipt win. Outcomes carry no multiplier.
Jammer: the crash point is min(max(floor(100 × num × 2^64 ÷ (den × (2^64 − w))), 100), 100000) hundredths, where w is the first big-endian uint64 of HMAC-SHA256(derived_random, "rgs-jammer-stream-v1" ‖ uint32_be(0)). The multiplier follows the integer curve X₀ = 10^8, X₍ₙ₊₁₎ = floor(Xₙ × 100300450 ÷ 10^8), M(n) = min(floor(Xₙ ÷ 10^6), 100000) with 50 ms ticks. Your browser checks that the receipt's end is the earliest event (auto exit, the cap, or the bust published 250 ms after the first tick above the crash), that a cash-out's multiplier lies in the window [M(at − 250 ms), M(at)] of its recorded receive time at, and that the win is floor(bet × multiplier ÷ 100); see docs/protocol.md § Jammer math 1.0.0.
Doomscroll: 25 rolls U(20) from rgs-doomscroll-stream-v1; swipe k busts iff its roll is ≥ 17, and the payout after k safe swipes is floor(bet × num × 20^k ÷ (den × 17^k)). Ghosted: 10 rolls U(20) from rgs-ghosted-stream-v1; a message sent normal, kinky or spicy gets a reply iff its roll is below 18, 15 or 10, and the payout is floor(bet × num × 20^n ÷ (den × 18^a × 15^b × 10^c)) over the a, b, c replies of each tone (n = a + b + c). Your browser recomputes the rolls from the revealed secret and checks every step of the outcome against them.
Baccarat: a fresh 8-deck shoe (416 cards) per coup; the first six positions are drawn by a partial Fisher–Yates shuffle, j = i + U(416 − i), over "rgs-baccarat-stream-v1"; the cards are dealt player, banker, player, banker, then the third cards by the standard tableau. A winning bet pays floor(bet × c ÷ 100) (player 2.00, banker 1.95, tie 9.00); a player or banker bet pushes on a tie. Mole: three moles from a partial Fisher–Yates shuffle of the nine holes, j = i + U(9 − i), over "rgs-mole-stream-v1"; the payout is floor(bet × c ÷ 100) for the profile's value c at (marks, hits). See docs/protocol.md § Baccarat math 1.0.0 and § Mole math 1.0.0.
Dice: the roll is X = U(10000) over "rgs-dice-stream-v1", shown as X ÷ 100. Under wins iff X < w and over wins iff X ≥ 10000 − w, where w is the chance in hundredths of a percent; a win pays floor(bet × num × 10000 ÷ (den × w)) for the profile's num/den. See docs/design/phase24-originals-design.md § 3.
Rock Paper Scissors: the opponent is opp = U(3) over "rgs-rps-stream-v1" (0 rock, 1 paper, 2 scissors). (pick − opp) mod 3 = 1 is a win paying floor(bet × (3 × num − den) ÷ den) for the profile's num/den, 0 is a draw that refunds the bet, and 2 is a loss paying nothing. See docs/design/phase24-originals-design.md § 5.
Limbo: X = U(2^52) over "rgs-limbo-stream-v1", one word, never rejected. The result is max(100, floor(100 × num × 2^52 ÷ (den × (X + 1)))) hundredths of a multiplier, uncapped, and a bet on target T wins iff the result ≥ T. A win pays floor(bet × T ÷ 100), the target and never the result. See docs/design/phase24-originals-design.md § 4.
Keno: ten numbers are drawn without replacement from the ascending list 1 to 40 over "rgs-keno-stream-v1": for i = 0 to 9, j = U(40 − i) and the i-th number is removed from the list at index j. The hits are the picks that were drawn, and the payout is floor(bet × M ÷ 10^8) for the profile's stored table value M at the risk, the pick count and the hits. See docs/design/phase24-originals-design.md § 6.
Coin Flip: ten fair bits v_k = U(2) from "rgs-coinflip-stream-v1" (0 = heads, 1 = tails), all drawn when the round opens. A call wins iff it equals the flip, and after k correct calls the payout is floor(bet × num × 2^k ÷ den) for the profile's num/den (the stake back if the round times out before the first flip; nothing on a bust). Your browser recomputes the ten flips from the revealed secret and checks every call and the ending against them. See docs/design/phase24-originals-design.md § 7.
Hi-Lo: 11 cards are drawn without replacement from the ids 0 to 51 in ascending order, j = U(52 − i) over "rgs-hilo-stream-v1" (suit = id ÷ 13 in S, H, D, C; rank = id mod 13 + 1). A guess survives iff the next card is strictly higher or lower, and an equal rank loses. The multiplier after the guesses taken is num ÷ den × Π (52 − m) ÷ w_m, where w_m is the number of remaining cards that win guess m, and the payout is floor(bet × num × Π(52 − m) ÷ (den × Π w_m)), the bet if you stopped before the first guess, and 0 on a bust. A guess with no winning cards, or one that would take the multiplier above 1000, would have been refused, so a receipt containing one fails. See docs/design/phase24-originals-design.md § 8.
Wheel: index = U(n) over HMAC-SHA256(derived_random, "rgs-wheel-stream-v1" ‖ uint32_be(i)) read as big-endian uint64 words, and the payout is floor(bet × c ÷ 100) for the profile's table value c at that index; see docs/protocol.md § Wheel math 1.0.0 and profiles.
—————For each level: index even → SHA-256(current ‖ sibling), odd → SHA-256(sibling ‖ current), then index ÷ 2. Each line below is that level's concatenation.
———batch key = 16 zero bytes followed by the 16 bytes of the batch UUID (docs/protocol.md § Anchor encoding v1).
——————————The explorer link and contract address are supplied by the RGS; compare the contract address with the project's published documentation.
This page may contact only the listed public nodes or a node on your own machine (http://localhost or http://127.0.0.1).
RGS server Not performed
(a) Polygonscan: open <explorer>/address/<contract>#readContract, choose getAnchor, paste the batch key <batch_key>, then compare root with 0x<stored root> and leafCount.
(b) curl:
The result is 4 × 32 bytes: root, leafCount, blockNumber, timestamp.
The contract source and artifact are in contracts/, and cmd/anchor status compares runtime bytecode.