Costs and proofs

Measured, not estimated

These come from forge test on a fork of Robinhood Chain on 2026-10-15. Gas on a different day or after a chain upgrade can differ. A gas number in ETH or dollars would depend on the price of gas at that moment, so we do not quote one.

The tests

• 3 real drand rounds are verified and their random value matches the one the relays publish.
• 8 rejections: flipped bit, signature of another round, round plus one, a point outside the subgroup, wrong lengths, bad compression flags, a coordinate above the modulus, the wrong sign.
• CricketDraw: commit too soon, bad terms, reveal before the round exists, reveal by a stranger, double reveal, wrong signature (the draw stays revealable afterwards), unknown draw.
• Differential: the winner selection in JavaScript and in Solidity agree on 200 random cases.
• Uniformity and no repeats for the draw.

What proves what

Forge runs the BLS precompiles locally on a forked state. It does not prove that the real chain exposes them. That is proven separately by node scripts/real-chain-check.mjs, which calls the real chain with eth_call on the precompiles themselves, without deploying anything:

chain 4663  (Robinhood Chain, live BLS12-381 precompiles 0x0b 0x0f 0x10)
OK        round 33091443: e(sig, G2) == e(H(round), key)
refused   a forged signature (the real one plus the curve generator)
refused   the same signature claimed for round + 1
refused   a real signature from another round

Not measured

Very large lists: winner selection is quadratic in the number of winners, tested up to 20. Draw first, publish the list, and keep winner counts small, or pick winners off chain and reveal with the proof.