Fairness and security
Committed seeds you can replay, caps and what is not guaranteed.
Two questions matter in a game that pays real tokens: can the dice be rigged, and can the system be gamed? This page lists what the game does about each, and says plainly what it cannot promise.
The dice can be checked
Whether a drop is tipped, and whether it is a big tip, is decided by a seed and nothing else. The seed is made so that neither the game nor the player can pick it.
- 1The game commitsBefore your shift, the game shows a hash of its secret seed for it. It cannot change the seed afterwards without the hash no longer matching.
- 2You add yoursWhen you dispatch, your browser adds its own random seed and the hash it saw. If the hash changed, the shift is refused.
- 3Both are mixedThe shift's seed is a hash of the game's seed, your seed and the shift's id. The game's seed is published as soon as the shift starts.
- 4Anyone replays itEvery roll is a plain hash of the seed and the drop number. The same code the game runs recomputes a finished shift, and the map is a replay of that same result.
What a shift pays depends only on the seed, the start time and the crew's settings. The city and the route are only the picture.
Guards against gaming
| Risk | What stops it |
|---|---|
| One account taking the whole stream | No account earns more than 10% of the stream |
| Round-the-clock bots | Every account needs the pack, and none earns more than 10% of the stream. Time on a shift is not limited: a crew on the road all day earns all day, a bot's as much as a player's |
| Buying power once and leaving it idle | Only crew that worked in the last day counts as power |
| Free accounts | A trial account has no power. Gold, cosmetics and invites give no power either |
| Farming the season with bought gold | Season score is gold made on shifts. Bought and invited gold do not count |
| Buying crew cheaply by pushing the pool's price up | The shop gets cheaper only once a rise has held for about 3 minutes (the median of the last 5 minutes of the pool's price), so a push of a few seconds buys nothing cheaper. See Prices |
| A claim losing value to rounding | Unclaimed balances are kept as exact amounts, never as shares, so a payout cannot be taken by another account |
| The books drifting from the vault | A check about once a minute. Withdrawals stop if it fails. See Proof of reserves |
What is not guaranteed
- The size of your share. It depends on spending, on the crowd and on your power, see The live share.
- That the CONVOY price holds. The shop follows the price with a delay, and the token can fall as well as rise.
- That the game stays as it is. Its settings are still being tuned and can change.
- That the system is free of bugs. It is checked by tests, including SQL tests that must agree with the simulation, but no system is certain.
The place to check the books is the reserves page, and the place to check the pool is the pool page. How the vault is protected is in Proof of reserves.