Draw Process

The Participant List

Before any winner is chosen, Roffle generates a final, digitally signed list of every valid ticket entered into the draw. This list is "frozen" and made available for public view on the specific Roffle listing page. This ensures that no tickets can be added or removed once the "countdown" to the draw has begun.

Provable Randomness

We don’t use internal "random number generators" that could be biased. Instead, we use Drand, a distributed, public randomness beacon.

• Drand is not affiliated with Roffle; it is a global network that generates a new random number every 30 seconds.
• Because the number is generated by a distributed network, no one—including the Roffle team—can predict or influence the outcome.
• We assign a specific future "round" of Drand to each Roffle. The winner is decided by the number generated at that exact moment.

The Winner Selection

Once the Drand number is generated, our public algorithm uses it to select a winning index from the sorted list of participants.

• Because the participant list and the Drand number are both public, the result is transparent and can be checked by anyone.
• Every ticket has an equal mathematical chance of being selected based on the total number of entries in the list.

Finalising the Result

The draw happens in the afternoon on the first working day after entries close.

• This window allows our team to scan any final postcards that arrived in the morning mail to ensure every valid entry is included in the final participant list.
• Winners are notified immediately via email and have 7 days to claim their prize.

The Algorithm

1. Roffle hosts its public key at /public-key path
2. An hour before the draw, Roffle releases a digitally signed list of all participating tickets at <draw url>/participants, referred to as Participants
   1. a link to this list will appear on a product page when it becomes available
   2. the signature of this list is sent to all participants via email
   3. the signature can be verified using Roffle public key and standard Ed25519 algorithm
   4. list contains ordered tickets, along with anonymized IDs of their owners
   5. list also contains details of the draw: exact date, drand chain, public keys used for verification and some other metadata
   6. there is no difference between paid and free entries; the list does not disclose the type of each ticket
3. After Participants list is generated, Roffle may create ticket list revocations, referred to as Updates, in a similar format (public signed document). These state which tickets, and for what reason, are revoked
   1. Roffle does not send out emails for every Update, as that could be considered spam
   2. note that these revocations can happen even after the draw, and may trigger redraws if they happen to revoke a winning ticket.
   3. each Update specifies its own Round number, independent of the original draw
   4. Updates are released at least one hour before their respective Rounds
   5. they are available on the same page as the original Participant list
4. At the time of draw, drand generates a random number, referred to as Round
   1. drand is not affiliated with Roffle, and is as independent and random as it gets
   2. Round numbers are generated both for original Participants, as well as future Updates
5. The draw results can be calculated using Rounds, Participants and Updates with the following algorithm:
   1. verify the signature of Participants, all available Updates and all generated drand Rounds
      1. verification of Participants and Updates uses Ed25519 as described above
      2. verification of drand Rounds is more complex and beyond the scope of this document
   2. sort all tickets by their number, ascending (i.e. #1 goes before #2), further reffered to as List
   3. for each prize in the draw:
      1. count tickets in the List as Count
      2. prepare Info bytes by concatenating Count as 32-bit unsigned integer (4 bytes), and roffleId parameter encoded with UTF8
      3. calculate Result as 64 bytes of HKDF-SHA512 with the Round as input key material (64 bytes), empty salt, and the above Info as info parameter
      4. calculate Index as Result modulo Count (simple math, although on a very large number)
      5. remainder bias is ignored as it's astronomically small and doesn't justify complicating the algorithm
      6. find the ticket at the Index position in the sorted List - this is the winning ticket
      7. remove from the List all tickets belonging to the same owner (i.e. having the same anonymous ID) as the winning ticket, including the winning ticket
      8. repeat these steps for the next prize draw, if any
   4. once all prizes from the original Participant list are drawn, for each ticket revocation Update available:
      1. remove all revoked tickets from the List
      2. if this removes a winning ticket, immediately draw another prize using instructions in 5.3 and Round specified in the Update
      3. note that it's not necessary to wait for drand Round of an Update when it doesn't revoke any winning tickets
      4. also note that this step is allowed to select a ticket that will get immediately revoked by some future Update
   5. the drawn prizes become final when they are delivered to the winners, as it's no longer possible to revoke any of them at this point