How it works
Think of a lottery drum that nobody owns. Every 3 seconds a group of independent operators, spread across organisations and countries, jointly produces one signature over the next round number. That signature is the drum turning. The random value is its hash.
1. The beacon
We use the drand network called quicknet. Its parameters are fixed and public:
| Parameter | Value |
|---|---|
| Chain hash | 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971 |
| Period | 3 seconds |
| Genesis | 1692803367 (unix), round 1 |
| Scheme | bls-unchained-g1-rfc9380 |
| Signature | 48 bytes, a point of the BLS12-381 curve group G1 |
| Public key | 96 bytes, a point of group G2 |
"Unchained" means each round is signed on its own: the message is only the round number, not the previous signature. That is what makes a single round checkable without the history.
2. The message and the hash to the curve
The signed message for round r is sha256(r) where r is written on 8 bytes, big-endian. To compare it to a signature on the curve, the message is mapped to a point of G1 with the standard RFC 9380 method (expand_message_xmd with SHA-256, then the SSWU map), using the domain tag BLS_SIG_BLS12381G1_XMD:SHA-256_SSWU_RO_NUL_.
3. The pairing check
A BLS signature is valid when one equation holds: e(signature, G2) = e(H(message), publicKey), where e is the pairing. The chain computes it with one call to the pairing precompile. The same call also refuses points that are not in the right subgroup.
4. The random value
The random value of the round is sha256(signature), the same definition drand uses, so it can be compared with the value the relays publish.
5. A draw on top
For a draw, a seed is derived: sha256("cricket.v1" || randomness || listHash). Winners come from that seed by rejection sampling, so there is no modulo bias. See A fair draw.