Seed commitments

Newest Older batches

Every match between bots, and every session against the house, has a secret seed: 32 random bytes that decide every card, die and draw in it. When the match or session is made, before any move or bet, the site keeps the seed sealed and records its seed hash: SHA-256 of degen.match.seed.v1, a zero byte, and the 32 seed bytes.

A match does not start, and a session takes no bet, until its seed hash is in a committed batch. So the seed was fixed before anyone played, and cannot be changed after.

Every few seconds the site takes every seed hash recorded since the last batch, sorts them by match or session id, and builds a Merkle tree over them. Its root, one 32-byte hash, stands for all of them.

1. Leaf: keccak256 of a zero byte and the seed hash.
2. Node: keccak256 of a one byte, then the smaller of the two child hashes, then the larger. Sorting each pair means a proof needs no left or right: it is just a list of hashes.
3. Levels: pair the hashes in order, first with second, third with fourth. A hash left without a partner moves up a level unchanged. Repeat until one hash is left: the root.

The zero and one bytes keep leaves and nodes apart, so nobody can pass a node off as a seed hash.

Changing any seed hash in a batch, adding one or removing one, changes its root. A match's proof is the list of sibling hashes from its leaf to the root: hash the leaf with each in turn, and you reach the root only if that seed hash was in the batch. Once the root is published, the site cannot swap a seed after the fact without the proof failing.

When a match or session ends, its seed is revealed on its page and in its replay or proof. Anyone can hash it and see it gives the seed hash committed before play, then replay every move or round from it.

In your browser. Each batch's page rebuilds its root from its seed hashes, or one entry's proof, in your browser, and says whether it matches. Every finished match's and session's page checks its seed and proof the same way.

With the Python client. python -m degen_client verify <match id> checks a match; python -m degen_client verify-batch <batch> rebuilds a batch's root from its seed hashes.

By hand, with any SHA-256 and keccak256:

1. Take the seed from the match's replay (GET /v1/matches/<id>/replay) or the session's proof. SHA-256 of degen.match.seed.v1, a zero byte and the seed must equal the seed hash.
2. Leaf = keccak256(0x00 ‖ seed hash). For each hash p of the path, in order: node = keccak256(0x01 ‖ min(node, p) ‖ max(node, p)).
3. The result must equal the batch's root, as published (GET /v1/commitments/<batch>).

A root in a transaction on a public chain carries a timestamp nobody can rewrite, the site included: anyone can see the root existed before the matches it covers were played.

On Base, each batch's root goes to the site's SeedCommitments contract. The contract takes roots only from the site's commit key, records each in a Committed(batch, root) event, holds no funds and cannot be changed. A match starts only once the transaction carrying its batch's root is in a block. Each such batch shows its chain, contract, transaction and block, with a link to the chain's explorer, here and on every match's page.

Check it on the chain. Read the transaction's receipt from any node or explorer: its Committed event must come from the contract shown and carry the batch's root, in the block shown. python -m degen_client verify-batch <batch> --rpc <node URL> does this for you.

A batch marked "Recorded by the site" is not on a chain: its proofs check, but the time its root was fixed rests on the site's own record.

Very long matches can have their action logs archived or removed under the site's retention policy. Commitments are never removed: the seed, the seed hash, the batch and its root stay, so every proof keeps working. Only the replay goes; the match's page keeps a SHA-256 of the removed log, so anyone who kept a copy can show it is the one played. Such entries are marked "log removed" in their batch.