How fairness works

1. We pick the cards. A case is a fixed list of real, graded, vaulted cards. We write the list of card ids down, sorted, and hash it. That hash is the manifestHash. It proves the set of cards cannot change after publish.
2. We draw a secret seed. 32 random bytes. We publish only its hash, the seedHash. The seed itself stays secret while the case is selling.
3. We publish a commitment. One more hash that ties the fairness version, the seed hash and the manifest hash together. This is the fingerprint shown on the case page and in the table below.
4. The seed shuffles the cards. A standard Fisher-Yates shuffle driven by a keystream derived from the seed places each card in a numbered slot. Same seed and same manifest always give the same order, so anyone can reproduce it later.
5. Each purchase takes one slot. Your browser sends a random clientSeed with the order. We hash the secret seed, the purchase number (nonce) and your clientSeed, and use that hash to pick one of the remaining slots. The proof of that pick is stored on your pull and shown on your order.
6. We reveal the seed. When a case sells out or is retired, the seed is published. From that moment the whole thing is checkable: the commitment, the shuffle and every pick. The verifier does it in your browser.

These are copied from the comments at the top of our fairness module. Version string: packrip-fairness-v1. All hashes are SHA-256 over UTF-8 text, printed as lowercase hex.

manifest      = JSON array of item ids, sorted (what is in the box)
manifestHash  = sha256(manifest)
seed          = 32 random bytes (hex), kept secret until the case sells out or retires
seedHash      = sha256(seed)
commitment    = sha256(`${version}|${seedHash}|${manifestHash}`)
order         = fisherYates(manifest, keystream(seed))   -> slot index i holds order[i]

nonce         = number of units sold in this case before this one (0-based)
clientSeed    = entropy supplied by the buyer's browser (or empty string)
remaining     = sorted list of slot indexes still AVAILABLE
pick          = int(sha256(`${seed}|${nonce}|${clientSeed}`)) mod remaining.length
slotIndex     = remaining[pick]

block(counter) = HMAC-SHA256(key = seed, message = String(counter))
each block yields eight 32-bit big-endian unsigned integers (4-byte steps)

nextInt(n):
  limit = floor(2^32 / n) * n
  take v from the stream until v < limit
  return v mod n

fisherYates(arr):
  for i from arr.length - 1 down to 1:
    j = nextInt(i + 1)
    swap arr[i], arr[j]

• The manifest cannot change. Adding, removing or swapping a card after publish would change the manifest hash and break the commitment.
• The order cannot change. The seed determines the shuffle. A different seed would not hash to the published seed hash.
• We cannot steer your slot. Your pick depends on your clientSeed, which we do not see until your order is placed and which is part of the proof. The nonce is the count of units sold before yours, serialized in the database, so we cannot reorder purchases either.
• We cannot predict the next buyer's slot. Because the next buyer's clientSeed is random and unknown to us, we cannot know which slot they will get, so we cannot time our own purchases around good slots.
• Owners and staff are prohibited from purchasing. This is a rule in our terms and an internal policy, not a mathematical guarantee. Anyone with access to the seed could, in principle, know the order; the clientSeed mechanism above is what stops that knowledge from being useful for picking a slot.
• Slot picks are uniform. Every remaining slot has the same chance on every purchase. Our test suite checks this statistically.

Commitments are shown the moment a case is published. The seed is returned by the verifier once the case has sold out or been retired.