How to verify this draw yourself

You don't have to take our word for it. Each step below can be repeated with free tools or a few lines of code. The values appear in the record above once the entries are locked.

1. Check the ticket list's fingerprint. Take the full ticket list exactly as published (one line per entry, such as 41-50 XMAS-7KQ2M9, lines separated by a single line break, no blank line at the end) and work out its SHA-256 hash with any SHA-256 tool. It must equal the “List fingerprint”. Also check your own reference is in the list, with the ticket numbers in your confirmation email.
2. Check the random number was committed in advance. We choose a drand round number when we lock the entries. drand publishes one round every 30 seconds, and a round's time is its chain's start time plus (round − 1) × 30 seconds, both shown at api.drand.sh/info (genesis_time and period). That time must be after the lock time on this page. The “Check this draw myself” button does this sum for you.
3. Check the drand round is genuine. Fetch the round from drand yourself. Its randomness must equal the “Beacon randomness” here, and must be the SHA-256 hash of its signature (the signature is a hexadecimal number: hash its bytes). The signature itself is a BLS signature that any drand client can check against the chain's public key at api.drand.sh/info; this draw uses drand's default chain (scheme pedersen-bls-chained), where the signed message is the SHA-256 hash of the previous round's signature followed by the round number. Our server runs this check, and records that it passed, before it will draw a winner. drand is run by the League of Entropy: see drand.love.
4. Work out the winning ticket. Let total be the number of tickets in the list (add up each line's last number minus first number plus one). For i = 0, 1, 2…: build the text randomness:fingerprint:i (the beacon randomness, a colon, the list fingerprint, a colon, then i), take its SHA-256 hash, and read the first 12 hexadecimal digits as a whole number v (this is a number below 2⁴⁸). If v is at or above 2⁴⁸ − (2⁴⁸ mod total), throw it away and try the next i, so every ticket is exactly equally likely. Otherwise the winning position is k = v mod total, counting from 0. Walk down the list in order, counting each line's tickets (last − first + 1) one after another; the winning ticket is the (k + 1)th ticket counted. Gaps in ticket numbers (from refunded entries, for example) are not counted. The result must match the “Winning ticket” and reference above.

The code that does step 4 is the same in our server and in this page's checker. If any step doesn't match, tell us at hello@playfundwin.com.