Use
Verify a round
The verifier in src/engine/beacon.mjs returns every step so a page can show them. Same order in the contract.
The steps
| Step | What is checked | If it fails |
|---|---|---|
| message | sha256(round), 8 bytes big-endian | Cannot fail. |
| signature | 48 bytes decode to a point of the G1 subgroup | Wrong length, wrong flags, off the curve, or outside the subgroup: rejected before any pairing. |
| key | the network key is a valid G2 point | Cannot fail with the built-in key. |
| hash | hash_to_curve of the message onto G1 | Cannot fail. |
| pairing | e(signature, G2) = e(hash, key) | The signature is not the network's for this round. |
Try to break it
The home page offers three attacks and all three are refused at the pairing step: flip one bit, claim the signature belongs to round + 1, use another round's signature. The contract tests include the same cases plus malformed encodings.
What "valid" means
Valid means: the network key signed exactly this round number. It does not mean the round is recent. A year-old round is valid forever. Freshness is the job of the contract that uses it, which is why the draw contract compares the round to block.timestamp.
Speed
In JavaScript, one verification takes about 50 ms on a laptop (measured with Node 24). The page shows the time it measured on your machine.