Provably fair giveaways

Every Skincash giveaway is drawn with a scheme that anyone can independently verify after the fact. Nobody at Skincash — including the team — can predict or bias the outcome.

Before the draw: commit

When we create a giveaway, we generate a random 256-bit server seed. We do not publish the seed itself — we publish only its SHA-256 hash. That hash is the commit, and it is frozen in the database the moment the giveaway goes live. Because SHA-256 is one-way, knowing the hash does not let anyone guess the seed.

External entropy: EOS block

At the moment of the draw, our cron worker queries the EOS blockchain for the latest irreversible block and records its block hash. EOS blocks are produced every half-second by an independent network, so the block hash at any future instant is unpredictable at commit time. This means even Skincash cannot influence the draw.

Reveal and draw

The winning ticket is computed as: winningTicket = (BigInt(sha256(serverSeed + publicSeed + eosBlockId)) mod BigInt(totalTickets)) + 1. After the draw, we publish the server seed along with the block ID, public seed, and total tickets, so anyone can reproduce the hash and confirm the winning ticket.

const crypto = require('crypto');

// Published data (visible on the giveaway card)
const serverSeed   = '<revealed after draw>';
const publicSeed   = '<published at draw>';
const eosBlockId   = '<EOS block hash at draw time>';
const totalTickets = <total sold>;

const hash = crypto
  .createHash('sha256')
  .update(serverSeed + publicSeed + eosBlockId)
  .digest('hex');

const winning =
  (BigInt('0x' + hash) % BigInt(totalTickets)) + 1n;
console.log('Winning ticket:', winning.toString());

How to verify

On any past giveaway card, click Verify Fairness. The modal shows all four inputs, runs a client-side SHA-256 to prove the commit-reveal pair is valid, and provides a copy-pasteable snippet you can run in Node or a browser console to reproduce the winning ticket locally.