# OCVS-1 — the Open Crash Verification Standard

Version 1.0 · public domain · no licence, no attribution required.

Anyone may implement this. Anyone may host the verifier. Nobody needs our
permission, and that is the point: **a standard one company controls is not
verification.**

---

## What it is for

A crash game asks a player to trust that the multiplier was decided before they
bet. Almost every operator says so. Nothing in a normal game lets a player check
it. OCVS-1 is the smallest set of rules under which a player can check a round
themselves, on their own device, without the operator's help and without
believing anything the operator says.

---

## The five values

An operator publishing to this standard gives a player five things per round.

| | | |
|---|---|---|
| **commitment** | before the first round of a chain | 64 hex characters |
| **seal** | before this round runs | 64 hex characters |
| **salt** | before this round runs | text, contains a player-supplied nonce |
| **key** | after this round ends | 64 hex characters |
| **position** | the round's place inside its chain | a whole number ≥ 1 |

---

## The three checks

**1 · The key matches the seal.**

    SHA-256(key) == seal

The seal was public before the round. If the key produces it, the key existed
beforehand and was not chosen after seeing the bets.

**2 · The crash comes from the key.**

    h     = HMAC-SHA256(message = salt, key = key)
    x     = first 13 hex characters of h        (52 bits)
    U     = (x + 1) / 2^52                      (0 < U ≤ 1)
    crash = floor(((1 − edge) / U) × 100) / 100
            never below 1.00, never above the published cap

Floored, never rounded: rounding up returns a sliver of the edge every round and
makes the published RTP a lie by a small amount, forever.

**3 · The key belongs to the published chain.**

    SHA-256 applied to the key, `position` times, == commitment

This is the check that needs no knowledge of any other round. It ties one key to
a commitment published before any of them ran.

---

## What an operator must do

- Publish the **commitment before the first round of a chain**, somewhere a
  player can see it and a third party can archive it. A commitment published
  afterwards proves nothing whatsoever.
- Publish the **seal and salt before the round**, the **key after**.
- Let the **player contribute the nonce** inside the salt. Without it the
  operator alone chooses both inputs.
- **Never re-mint a chain in place.** Chains run out; lay the next one end to end
  with its own commitment, published in advance. Overwriting a chain makes every
  receipt ever issued unverifiable.
- Publish the **edge and the cap**, per market, dated. A return that changes is a
  new dated epoch, never an edit — a round played last month must still verify
  against the numbers it ran under.

## What an operator must not do

- No per-player, per-session, per-tier or per-time-of-day return. Per market is
  legal; the rest is a rigged game with better vocabulary.
- No outcome drawn from anything a person can set: no cursor, no cycle, no
  pattern, no queue position, no "force high odds" switch.
- Nothing on screen may be derived from the crash point before the crash.

---

## Verifying without us

A verifier is one HTML file. It needs no network, no account and no server. Save
it, disconnect, and it still works — that is the test of whether a verifier is
one.

The reference implementation is `verifier.html`. It is public domain too. If you
implement your own and it disagrees with ours on any round, ours is the one to
doubt first.