Leave this off to cash out by tapping. Set it and you stop automatically — 2× means you double your stake and get out.
Fairness for this round
—sealed until the round endsThe commitment is published before betting opens. The crash point comes from that seed combined with every player's key — so it cannot be chosen after seeing who joined.
Balance over time
Cash-out rate
Where rounds ended
Bars are what actually happened. The dashed line is what the published maths predicts. They should converge — that is the point.
Recent rounds
Your key
Share this so friends can send you sats.
—
Add sats
Scan with any Lightning wallet. Your balance updates once it settles.
Cash out
Pick an amount and scan the code with your Lightning wallet. Your wallet pulls the sats — you never make an invoice.
Paste an invoice instead
If your wallet cannot scan LNURL, make an invoice for the amount and paste it here.
Send sats
Every change to your balance
Check any round
Enter a round number. Your phone recomputes the outcome from the published seeds — it does not take the server's word for anything.
Underlying tech
- Identity
- Ed25519 signed challenge, single-use and replay-proof. Hybrid Ed25519 + ML-DSA-65 (FIPS 204) is implemented and tested server-side; browser signing lands with the WASM module.
- Transport
- TLS 1.3 with X25519MLKEM768 hybrid key exchange when served over HTTPS — post-quantum against harvest-now-decrypt-later
- Fairness
- SHA-256 commitment, HMAC-SHA256 outcome derivation. Hash-based, so Grover only halves the margin: quantum-resistant as it stands.
- Settlement
- Bitcoin and Lightning sign with secp256k1, which is not post-quantum. No application choice changes that.
- Simulation
- Q32.32 fixed-point, zero floating point, bit-identical replay
- Ledger
- Append-only double-entry, DB-enforced, audited every request
- House edge
- 1.00% — verified by test across 2,000,000 simulated plays
- Licence
- AGPL-3.0 — every line auditable, forks must publish