terms used
• client seed: a string chosen by the player (or automatically generated if you don't choose one)
• server seed: 64-hex string generated using crypto.randomBytes(32) and hashed with SHA-256
• nonce: the number of the round you're on, increases by 1 for every round across all house games
• cursor: internal number representing a nonce within the round, in mines - there are 24 cursor values for each round, and the cursor increases for each "shuffle" of the 0-24 tiles
• HMAC: cryptographic function that mixes unhashed server seed, client seed, nonce and cursor to produce a result
here's a 3rd party HMAC tool to verify each step for yourself: https://cryptii.com/pipes/hmac - (or any other one you prefer)
basics
mines uses the "Fisher-Yates" shuffling method to shuffle numbers from 0-24, each corresponding to a tile on the mines grid.
these are shuffled one by one for every round, with the "cursor" increasing for each shuffle
as soon as the round starts, the mine positions are already predetermined. selecting squares doesn't change where mines will be
how HMAC is used to determine shuffles, example round to demonstrate
unhashed server seed: cb8bd577e2b1f62e91c0fe5296c145330bc8ae4307729a372aa4fe639a5af24c
client seed: 62OUyVeUGCRnTpU6
nonce: 9521
cursor: 0 (starts at 0 for each round, stops at 24)
here's what the HMAC "message" looks like for calculating the first shuffle <clientSeed:nonce:cursor> = 62OUyVeUGCRnTpU6:9521:0 (the second shuffle would be 62OUyVeUGCRnTpU6:9521:1)
the "key" part is your unhashed server seed
if you're using the 3rd party site above to follow along it would look like this:
these values result in the following hexadecimal string:
74f1db86b36de10da7b05e82c047ba9bb6996087ab77824ccfee537f122193ea
how do you make a bomb from those numbers?
each string is sampled 4 bytes (8 characters) at a time and compared to the maximum acceptable fairness range which excludes 21 of the possible 4,294,967,296 results to eliminate any bias towards tiles 0-20
in this case the first 4 bytes would be "74f1db86", this is then converted from hexadecimal → decimal (74f1db86 → 1962007430) and compared to the maximum accepted fairness range.
since 1962007430 is less than 4,294,967,275; the number is accepted and used for calculating the first shuffle, which looks like this:
1962007430 % 25 = 5 (meaning if you divide x by 25, what number is left over)
the grid sequence looks like this before shuffling:
shuffling works by swapping a number from a specific position in the sequence with the last number which hasn't been swapped yet, in this case it'd be swapping 5 (6th number in the sequence) with 24 (25th number in the sequence) the last number is now locked in as 5.
grid sequence after first shuffle:
next shuffle uses 62OUyVeUGCRnTpU6:9521:1 as the "message" part, which gives 734934506 as the decimal number
since the 25th slot is already decided, the calculation is 734934506 % 24 = 2 (next one would be x % 23 etc.)
grid sequence after second shuffle:
this is then done 22 more times, which results in the final sequence:
last step is comparing that sequence to the chosen mines count. the round used in the example had mines count set to 3 - which means the first 3 numbers reflect where mines would've been (tiles 3, 4 and 11)
how would you know if this was a scam
since you're actively contributing to what the outcome of each round is (selecting tiles), there's very little the casino could do in terms of rigging your game. the only way would be to bypass the provably fair system entirely and spawn a mine on the tile you select.
you'd instantly notice if that was the case, since your rounds would no longer be verifiable here
once you've committed to a client & server seed combination, your future rounds are locked in place. you can see this on the verify page, where the "nonce" can be increased for all client & server seed combinations to see what the results of your future rounds would've been (this can only be done after rotating the seed)
TL;DR
• mines provably fair works by combining your client seed, server seed, nonce and cursor to shuffle numbers corresponding to the grid in a random and unpredictable way
• mine placements are already determined before you select a tile, the ones you pick don't have any influence on where the mine is
• "Fisher-Yates" shuffling method is used for the final mine placements - meaning that for each round, the grid is shuffled 24 times, and the resulting sequence of numbers dictates where the mines are
• as long as you're able to set a client seed (after the hashed server seed is revealed), there's nothing the casino can do to rig the odds without players immediately noticing
• click diamond not bomb