Honest limits — read before any real PRL moves
- Two-player mode needs a live counterparty running this protocol. This page coordinates through shareable bundles, but it cannot force anyone to reveal a secret or co-sign a settle. A sore loser can stall until the timeout — then each side refunds its own deposit.
- "Provably fair" means the outcome is fixed before you bet and verifiable after — the dealer's sha256(secret) commitment binds the result before funding. It does not mean the dealer can't get lucky.
- Timeout is an absolute block height. After it passes, each depositor can unilaterally refund their own deposit — nobody can touch the other's coins. Until then, nobody can refund.
- Solo practice is a protocol demo. No PRL moves, no funding, no broadcast — it shows the commit → reveal → verify flow against a local dealer.
- Timeouts are capped at 52,560 blocks (~4 months at ~194s/block). The page shows a wall-clock estimate; the chain decides.
1 · Setup — agree the game
Pick a game, set the stakes and the timeout, enter both parties' keys. The page derives the tamper-evident game descriptor and both escrow addresses.
Game
Must be a future height, 144–52,560 blocks out.
Parties
Enter the private key only for your own role. Your counterparty's side takes an x-only pubkey — enough to derive the escrow, never enough to spend.
Game descriptor
2 · Commit — the dealer locks the outcome
The dealer generates a secret and publishes sha256(secret). The player must see this commitment before funding — the page enforces that order.
Dealer: publish commitment
Player: record the commitment
No commitment locked yet — the Fund step stays closed until one is.
3 · Fund — each side stakes its own escrow
Each party funds their own escrow address with exactly their stake. The two addresses share the 2-of-2 settle leaf, but each binds its depositor — a deposit can only ever refund to its depositor or settle 2-of-2.
Track funding
4 · Reveal — the dealer opens the secret
The dealer reveals the secret. The page checks it against the locked commitment, derives the outcome deterministically, and scores the winner. Anyone can re-verify this independently.
Dealer: reveal
Result
No reveal yet.
5 · Settle — the loser co-signs the winner's payout
The winner builds an unsigned settle bundle (both deposits in, winner paid out, exact fee). The loser imports it, re-verifies the outcome and the math independently, signs, and the winner finalizes + broadcasts after a double confirmation.
Winner: build unsigned bundle
Loser: import, verify, sign
Winner: finalize + broadcast
Broadcast needs two confirmations here. The tx is not sent until you confirm twice.
Refund — unilateral, after the timeout only
Once the chain passes the timeout height, each depositor can take back their own deposit alone — no counterparty needed. Before the timeout, the page refuses loudly.
Build refund
Refund transaction
No refund built yet.
Verify — standalone transcript check
Paste a game descriptor, the dealer's commitment and the revealed secret. The page answers PROVEN or NOT PROVEN — no keys needed, nothing leaves your browser.
Solo practice — the protocol against a local dealer
No PRL moves here. The page plays dealer: it commits sha256(secret) before you see it, then reveals after your bet. Every round is independently verifiable below.
Play a round
Round history
No rounds yet.