Skip to content
RandNext
Esc

Verify a draw

Recompute the winners of a Giveaway Picker draw from its revealed seed and the locked entry list. If every check passes, nobody changed the list or the result after the draw was locked.

Loading the verifier…

What the verifier checks

The randnext-draw algorithms in short — enough to reimplement them in any language. Each record’s algorithm field says which version it uses; draws created since October 2026 use v2.

  1. Normalize the list: split on line breaks, apply Unicode NFC, trim surrounding whitespace, drop empty lines, and merge duplicates if the draw says so. Keep the order.
  2. entries_hash = SHA-256 of the entries joined by \n (UTF-8, no trailing newline). It must equal the fingerprint published at lock time.
  3. commitment = SHA-256 of the revealed 32-byte server seed. It must equal the commitment published at lock time.
  4. final_seed = SHA-256 of VERSION (the record’s algorithm name, e.g. “randnext-draw-v2”), a zero byte, the seed, the entries hash and the parameters (id, winners, entries). v2 inserts the 32-byte beacon randomness before the parameters, and its parameters add beacon_round.
  5. Random numbers come from HMAC-SHA256(final_seed, VERSION + 4-byte counter), read as 32-bit big-endian integers, with rejection sampling for uniform ranges.
  6. A partial Fisher–Yates shuffle over positions 0…n−1 picks the winners in rank order.

For v2 records, also

  • The beacon: the record names a drand quicknet round fixed at lock time. Its randomness must equal SHA-256 of the round’s 48-byte BLS signature, and that signature must verify against the League of Entropy public key over SHA-256(uint64_be(round)). Anyone can fetch the same round from api.drand.sh.
  • The lock signature: RandNext’s Ed25519 signature over the lock statement (fingerprint, commitment, winner and entry counts, beacon round, draw and creation times), checked with the public key at /api/v1/draws/signing-keys.
  • The result signature: RandNext’s Ed25519 signature over the result statement (seed, beacon value, final seed, winning positions, draw time).

What this proves: the list and the number of winners were fixed before the seed was revealed, and the published winners follow from them. For v2 records the result also depends on a public beacon value nobody — RandNext included — could know at lock time, and the signatures let you prove later what RandNext published. It cannot prove the organizer didn’t run several draws, which is why records show whether a draw was announced in advance.

Full specification, trust model and Python reference script →