Fair randomness

"Random" is the easiest thing to fake and the hardest thing to prove. Here is exactly where BurnBola's randomness comes from and why no one — including us — can steer it.

Exactly half burns. Always.

First, the deterministic part: each round burns exactly ⌊N/2⌋ tickets out of N live ones. There's no probability cloud, no variance in the count — randomness only decides which tickets, never how many. Every live ticket has an identical chance; position, purchase time, and wallet contents are irrelevant. Survival odds per round: exactly 50% at even N, better at odd N (at 3 live tickets — 66.7%).

Where the random seed comes from

The burn selection is seeded by a dual-oracle commit-reveal scheme built on two independent randomness networks:

Two oracles, one discipline

The contract accepts randomness from two decentralized oracle networks — Switchboard On-Demand and ORAO VRF. Both work the same honest way: the contract first binds itself on-chain to a specific oracle randomness account before its value exists (the commit), and only accepts the value that account later produces (the reveal), verified cryptographically. Nobody — the oracle included — knows the value at bind time, and the bound account can't be swapped afterwards.

The switch

If a bound oracle account stalls (no value after ~75 blocks), the Keeper re-commits — to a fresh account, switching between the two oracle networks. One oracle having a bad day never stops a game; the discipline (bind first, verify the reveal) never relaxes.

There is deliberately no block-hash fallback: seeds derived from Solana's own block hashes are, in theory, grindable by a block's producer, and for a large jackpot we don't accept even that theoretical edge. Randomness comes from an oracle network or not at all.

The last-resort valve

And if both oracle networks somehow died for a very long stretch (~30 days of a stuck round), the game doesn't hold anyone hostage: a permissionless emergency mode opens where every holder exits at the fair per-ticket price and the game closes with refunds. Nobody's money can be trapped by a dead oracle — but no burn ever runs on weak randomness either.

What this rules out

• We can't pick winners. There is no instruction in the contract that accepts a winner from outside. The seed comes from an oracle's commit-reveal; the selection from the seed is deterministic public code.
• We can't re-roll. A committed seed is consumed exactly once; the commit is on-chain before the reveal exists.
• Players can't snipe. Ticket positions don't matter, and the burn order within a round gives no exit advantage — the exit price is fixed per round. Mid-game entry exists but happens only in exit windows, priced at the ticket's full live value (details) — there's nothing to snipe, and entries are closed before the randomness of the next burn is even requested.

Verify it yourself

Every commit, reveal, and burn is a public transaction on Solana. Each game card links to the chain; the burn selection can be recomputed from the revealed seed by anyone with the (open) program code. You don't have to trust the app's animations — the chain is the game.