Provably Fair Audit Checklist: 5 Things to Verify After a Bad Session

Published 2026-04-03 · Tags: guides, verifier, fundamentals

The exact 5-step check to prove any Stake session was honest. Takes 5 minutes, settles the 'was that rigged?' question forever.

After a rough session, the instinct is "something must be off", and the fastest way to settle that feeling is a proper provably-fair audit. This post is the exact 5-step checklist we use. Takes 5 minutes total, settles 100% of "was that fair?" questions.

The five things to check

1. Server seed hash matched the revealed seed, Stake committed and delivered
2. Nonces increment cleanly — no skipped rounds
3. HMAC-SHA256 outcomes match what was paid, the math was correct
4. Client seed was unchanged during the session, or if changed, verified per-subset
5. Game-specific payout rules were applied correctly — especially for Mines, Plinko, Keno

If all 5 pass, the session was mathematically honest, the loss was variance, end of story.

Prep: export your bet archive

Before starting, grab your recent bet history:

1. Stake → Settings → Archive (or Bet History)
2. Pick the date range of the session you want to audit
3. Export as JSON (not CSV, JSON has the nonce and seed data intact)
4. Save the file

You'll also need the revealed server seed, so rotate your server seed after the session (see our server seed post).

Step 1: Verify the server seed hash matches

The most important check. Confirms Stake didn't swap the server seed mid-session.

1. Take the revealed server seed (a long hex string)
2. Compute its SHA-256 hash
3. Compare to the server seed hash Stake showed you at session start (should be in your bet archive or visible in the seed info panel before you rotated)

If they match: Stake committed honestly. ✓

If they don't match: You've caught a cheat. Screenshot everything, file a complaint with Stake, post on social. This has never happened in 10+ years of provably fair operation.

How to compute SHA-256:

• Our Stake Verifier does this automatically — paste the revealed seed, it shows the hash
• In a browser console:

 const seed = "your_revealed_seed_here";
 const encoded = new TextEncoder().encode(seed);
 crypto.subtle.digest("SHA-256", encoded)
   .then(hash => Array.from(new Uint8Array(hash)).map(b => b.toString(16).padStart(2, "0")).join(""))
   .then(console.log);

• Command-line: echo -n "seed" | sha256sum

Step 2: Check nonce continuity

Open your bet archive. Each bet entry has a nonce field. Across the session, the nonces should go 0, 1, 2, 3, 4,... with no gaps.

Why this matters: if Stake skipped a nonce, they may have tried to hide an outcome (e.g. a big win they didn't want to pay). Provably fair doesn't allow skipping, every nonce must be verifiable.

How to check: open the JSON in a text editor, search for "nonce":. The values should be 0, 1, 2,... incrementing by 1 per bet.

If there's a gap: you've caught a skip, which would be a cheat. Same reporting path as above.

Real-world observation: in our analyses of thousands of bet archives, nonces are always clean. Never seen a skip.

Step 3: Verify HMAC-SHA256 outcomes

For each bet:

1. Take the revealed server seed, the client seed, and the nonce
2. Compute HMAC-SHA256(server_seed, client_seed + ":" + nonce)
3. Apply the game's math to convert the hash to the outcome (dice roll, crash multiplier, mine positions, etc.)
4. Compare to what Stake paid you

Manually: extremely tedious for 1,000+ bets.

With our Stake Verifier: paste the three values, it runs HMAC-SHA256 and the game's math, outputs the computed outcome. Compare to your actual result.

For scanning many bets: use the Deep Dive feature. Paste the seed values + a nonce range (e.g. "nonces 0 to 1000"), pick the game, and it computes every bet. Filter by "show mismatches", should be zero.

Step 4: Client seed continuity

Some players change their client seed mid-session. That's fine, but it matters for verification.

Check: does your bet archive show a single client seed for all bets in the session?

If yes: use that client seed for all verifications. Simple.

If no (client seed changed mid-session): split the session into subsets, each with its own client seed + nonce range. Verify each subset separately.

Why this matters: if you forget to split, you'd compute HMAC with the wrong client seed for the bets where it was different, and the computed outcomes wouldn't match the actual ones — falsely triggering a "cheat detected" when actually you just have a client seed tracking issue.

Step 5: Game-specific payout correctness

Even if the HMAC outcome matches, the game math applied to that outcome must match the published rules.

Each game has specific payout logic:

• Dice: roll = (first 5 bytes of HMAC as decimal) / (2^40 - 1) * 100 → compare to target
• Limbo: crash multiplier = something like 99 * (1 / (1 - hash_to_fraction))
• Mines: 24 "draw without replacement" rounds, each selecting a tile from remaining pool
• Plinko: N rows of binary left/right decisions, each using a new float from HMAC
• Keno: 10 balls drawn from 40 with removal
• Crash: completely different algorithm (SHA-256 hash chain, no nonce)

Our Stake Verifier implements all of these correctly. We maintain the code at packages/verifier-core/src/index.ts — a workspace package shared between the website and our browser extension, so what you see in the verifier UI is provably the same code that runs in the browser extension.

If the computed outcome in step 3 matches what the verifier produces, and the verifier follows Stake's published algorithm, the game math is correct.

Common audit findings

In our experience running thousands of audits for players (and on our own archives):

• Step 1 (hash match): 100% pass, Stake always delivers the seed they committed to
• Step 2 (nonce continuity): 100% pass, no skips ever observed
• Step 3 (HMAC outcome match): 100% pass — outcomes always match the math
• Step 4 (client seed continuity): always works if you split correctly
• Step 5 (game math): 100% pass, Stake's games implement the published rules correctly

Net result: 100% of suspicious sessions we've audited have turned out to be fair. The losses were variance, not cheating. This is also the historical record across every major crypto casino with public provably fair implementations.

When to do a full audit

Every time you feel "was that fair?" The cost is 5 minutes. The benefit is peace of mind forever.

Specific trigger events:

• You just lost a much larger-than-usual amount
• You noticed a pattern you can't explain (e.g. multiple hits of exactly 1.01× on Limbo in a row)
• A specific bet outcome felt "off"
• You want to post a rant online (prove it's warranted first)

Audit is NOT useful for:

• Long-term P&L questions (use Bet Analyzer for that)
• Tilt management (use Vault and session rules)
• Strategy optimization (use our strategy guides for Dice, Mines, etc.)

The time-value of a clean audit

Here's the underrated benefit of running the audit after a bad session: you prove to yourself the losses were fair, which makes it easier to accept and move on.

Without the audit, the "was that rigged?" thought can haunt you for months. You see posts online about "Stake is rigged" and you wonder. You avoid playing. You tell friends the casino cheats.

After the audit, you know. You might still hate the loss, but you know the math was honest. Your next session (if you have one) starts from a rational baseline, not paranoia.

This is what provably fair is actually for. Not to prevent cheating (the math already prevents it); to give you a way to prove cheating didn't happen.

Tools for the audit

• Stake Verifier, paste server seed, client seed, nonce range. Get computed outcomes.
• Bet Analyzer — upload bet archive, see nonce continuity and per-game stats.
• Session Rebuilder, replay the session visually to spot weirdness.
• Deep Dive in the Verifier, scan a nonce range for specific multipliers (good for "I almost hit X" claims).

The math-free version

If you don't want to run the audit yourself but still want peace of mind:

1. Export your bet archive
2. Drop it into our Bet Analyzer
3. Look at your per-game RTP — if it's within 2% of published for your sample size, variance is normal

This isn't a cryptographic audit, it's a statistical sanity check. Most players only need the sanity check.

Wrapping up

Provably fair gives you the ability to prove any Stake session was honest, in 5 steps, in 5 minutes, for free. Every audit we've ever run has confirmed the session was fair. The tool isn't for catching cheats (there are none); it's for giving you the ability to move on from a bad session without doubt.

Run the audit on your most recent session. Open the Stake Verifier →