Randomness

Draws use drand quicknet (bls-unchained-g1-rfc9380): a threshold BLS network run by independent organisations, with a beacon every 3 seconds. Nobody knows a beacon before the network publishes it.

Draw lifecycle

Step	Who	What happens
CloseDraw	anyone, after the period, with at least one player	fixes the drand round 20 rounds ahead, about 60 seconds
FinalizeDraw	anyone, with that round’s beacon	verifies the beacon, picks winners, asks the treasury for the rate
rate reply	treasury	computes the prize and credits the winners

While a draw is closed, deposits are returned and withdrawals refused, so weights cannot move once the beacon is public. The first winner is fixed in the finalize transaction, before the rate query. A lost reply is resent an hour later with the same winner.

On-chain verification

1. message = sha256(round); expand_message_xmd with SHA-256 and quicknet’s DST gives two 512-bit values.
2. Each is reduced modulo p. TVM integers are 257-bit, so the keeper supplies the quotient as a witness; the contract checks x = q·p + u with 128-bit limbs and u < p.
3. BLS_MAP_TO_G1 maps both and BLS_G1_ADD sums them.
4. BLS_PAIRING checks e(signature, −g2) · e(H, publicKey) = 1.
5. The randomness is sha256(signature), the same value drand publishes.

The built-in BLS_VERIFY is not used: it hard-codes the _POP_ DST, while drand signs with _NUL_. Verification costs about 62,000 gas, a whole finalize about 77,000. The tests check it against real quicknet beacons from round 1 to October 2026, plus forged signatures, wrong rounds and wrong witnesses.

Picking winners

• Weights live in a Fenwick tree in a dictionary. An update or lookup touches log2(players) nodes, at most 13 at the 8,192-player cap.
• The first winner holds ticket randomness mod totalPrincipal.
• Further winners, up to five, come from sha256(randomness, slot) over the same frozen weights.
• The jackpot goes to the first winner with probability 1 / jackpotOdds, otherwise it rolls over.

Checking a draw

The explorer’s Check against drand button runs the same checks in the browser: it fetches the signature from drand, verifies it against quicknet’s public key, checks that the vault’s randomness is its SHA-256, and shows the winning ticket. The code is the protocol’s client/drand.ts, shared with the keeper.

Why the lock

Odds count deposits at the moment of the draw. Deposits are locked for at least one period, enforced by the contract and the deploy config. Without it, entering just before a draw would take a share of yield others earned; with it, entering late costs a full period of yield, which is what the draw is worth on average.