Provably Fair

Astro doesn't ask you to trust it. Every round's crash point can be recalculated and verified independently, by you, after the fact.

Why not Chainlink VRF or Pyth Entropy

Astro is a real-time game with manual cashout. If the crash point were available on-chain the moment a round opened, as a standard oracle randomness request would make it, it would be publicly readable before anyone could bet, letting bots snipe every round. Astro needed randomness that's committed in advance but stays secret until betting closes.

How it works

1. Pre-generation: millions of seeds are generated off-chain ahead of time, each one the hash of the next (a hash chain), and only the final hash is anchored on-chain.
2. Public salt: when a round's betting window closes, the block that closes it is recorded. Its hash (unknowable by anyone, including Astro, until that block is mined) becomes the round's public salt.
3. Crash point: the crash point is a deterministic function of the round's still-secret seed and its public salt. Nobody can know it before the salt exists, and nobody can change it afterward.
4. Reveal & settle: once the round is decided, Astro reveals the seed on-chain. The contract checks it against the hash it committed to earlier, recomputes the crash point from (seed, salt), and settles every bet against that result.

Two locks, not one

The standard commit and reveal scheme publishes the hash of a seed before the round and reveals the seed after. That proves the operator did not swap the seed. It does not prove the operator did not already know the outcome while you were deciding whether to bet, because the seed alone determines it.

Astro splits the outcome across two ingredients that no single party holds:

• The seed is locked. Each seed in the chain satisfies keccak256(Seed[n+1]) = Seed[n], so the chain can only be consumed in one direction. Producing an unused seed would mean inverting keccak256. Only the final hash is written on-chain, before the first round is played, and every revealed seed must hash back into it.
• The salt is unpredictable. It is the hash of the block that closes the betting window. That block does not exist while bets are still open, so no party can know it or grind against it, Astro included.

The formula

This is the function the contract runs, in full, from CrashMath.sol:

function calculateCrashPoint(bytes32 seed, bytes32 salt, uint256 houseEdgeDivisor)
    internal pure returns (uint256)
{
    bytes32 hash = keccak256(abi.encodePacked(seed, salt));

    // Extract 52 random bits from the hash (bits 204-255)
    uint256 h = uint256(hash) >> 204;

    // House edge: 1/houseEdgeDivisor chance of instant crash at 1.00x
    // Default 33 = ~3% house edge, configurable range 20-100 (5%-1%)
    if (h % houseEdgeDivisor == 0) {
        return BASIS_POINTS; // 1.00x = instant crash
    }

    // Original Bustabit formula: floor((100 * e - h) / (e - h)) / 100
    uint256 numerator = 100 * E - h;
    uint256 denominator = E - h;

    if (denominator == 0) {
        return type(uint256).max;
    }

    uint256 crashBP = (numerator * BASIS_POINTS) / denominator / 100;

    if (crashBP < BASIS_POINTS) return BASIS_POINTS; // min 1.00x

    return crashBP;
}

With BASIS_POINTS = 10000 and E = 2 ** 52.

Nothing in that function depends on who you are, how much you bet, or whether you are up or down on the day. The house edge is a public constant in a public contract, not a line in a terms page.

Verify a round yourself

Every finalized round exposes its seed, its salt and its crash point. The check is three steps, and none of them need our permission.

1. Check the seed. Hash the revealed seed. keccak256(seed) must equal the hash committed before the round. If it does not, a seed was substituted, and you can prove it.
2. Check the salt. Look up the block the salt came from. Confirm it is the block that closed the betting window for that round, and that its hash is the value used.
3. Recompute the crash point. Run the seed and the salt through the function above. The result must be the crash point you were settled against.

The contract performs this same check on-chain before settling anything. You do not have to take our word for that either: the contract is public and so are the transactions.

Contract addresses

Astro's contracts on Robinhood Chain (chain ID 4663):