KaspaForge Arena Is Live: Provably Fair Blackjack on Kaspa L1

Every online casino ever built asks for the same thing before the first card is dealt: trust us. Trust that the shuffle was random, that the house didn't peek, that your balance will still be there tomorrow, that the payout table won't quietly change. The entire industry of licenses, auditors and "provably fair" seed hashes exists because none of that trust is checkable at the moment it matters — while your money is on the table.

KaspaForge Arena removes the request instead of decorating it. As of today Arena is a public mainnet beta: two permanent public blackjack tables, open to anyone with a browser and a few KAS. There is no casino account, no deposit balance, no platform token and no operator who could pay you less than the rules say — because the money never passes through an operator at all. The stakes sit in a Kaspa L1 covenant that knows the rules of blackjack, and the one thing the covenant cannot check by itself — the honesty of a deck it must not see — is closed by a zero-knowledge proof.

The problem: hidden information on a public ledger

Blockchains are good at money and terrible at secrets. Blackjack needs both at once: the pot must be locked by rules nobody can bend, while the deck must stay hidden — the whole game collapses if the player can see the dealer's hole card, and it collapses differently if the dealer can pick the shuffle. Most "on-chain casino" projects resolve this tension by quietly moving the interesting part off-chain: a server shuffles, a server deals, and the chain is reduced to a payment rail with a brand on top.

Arena keeps both halves honest and does it with five separate mechanisms, each answering a question the others cannot. There is no single "trust the ZK" shortcut — and no single point whose failure is silent.

A deck nobody can rewrite

The shuffle is the heart of the protocol, so it is worth walking through slowly. When the house opens a table, it funds a Room covenant that already contains the dealer's seed commitment — a hash that reveals nothing but can never be changed. When you sit down, one password confirmation in your Desk creates your table identity, verifies the room, signs the exact JOIN transaction and pins your seed commitment into the game state. From that moment the deck is already determined — neither side just knows it yet.

1. Your seed is revealed and checked against the commitment JOIN pinned. The dealer's commitment was fixed before you ever arrived, so neither side has seen the other's randomness before their own was locked.
2. The canonical Arena program derives one shuffle input from the game identity and both seeds, and performs an unbiased deterministic Fisher–Yates shuffle of all 52 cards. The same byte-exact program must produce the same order from the same inputs — there is no server-side "pick a deck" API to compromise.
3. The hidden deck becomes a SHA-256 Merkle tree. Only its root goes on-chain. Any card can later be opened together with a path proving it sat at exactly that position in exactly that deck.
4. A zkVM proves the whole computation. The proof's journal binds the rules, the game identity, both commitments and the deck root — a proof from another room, or the same room with different rules, simply does not verify.
5. Kaspa consensus verifies the Groth16 proof inside the very transaction that deals the first cards. Public tables use KaspaForge's hosted GPU prover, but its artifact is accepted only after an independent CPU verifier reports it valid — and the chain then checks it again. Only a verified deck can be dealt from.

Notice what this construction quietly deleted: the trusted shuffler. Nobody — not the dealer, not KaspaForge, not the prover — is in a position to know or influence the card order beyond the seeds they committed blind.

The covenant plays strict floor manager

From the deal onward, the entire hand lives in a single on-chain coin — the Game UTXO — and every move replaces it with a successor the covenant checks byte by byte. Hit and stand are real Kaspa transactions signed by your key. A revealed card must open against the proven deck root at the exact next index. Hand totals are recomputed inside the script itself, so a successor carrying correct cards but a doctored total is rejected by the network, not by a moderator. On Kaspa's 10-blocks-per-second BlockDAG, a move typically lands as an accepted transaction within a few seconds — fast enough that the cryptography disappears into the felt.

The covenant is just as strict about the ways a hand can end:

• Normal settlement pays a fixed list of outputs — winner, loser's bond back, exact service and prover fees — and nothing else. A "fee" that could be overpaid to smuggle value out simply is not a path that exists.
• The dealer's silence is your payout. If the dealer never proves the deck, never opens the hole card or never finishes resolving, keyless timeout branches — which anyone may broadcast — pay the whole bank and both liveness bonds to you, with no fees charged. A hand cannot hang, even if KaspaForge vanishes.
• Your silence is not a confiscation. If your turn expires, the covenant simply stands for you and the hand plays out under the same rules. The only stake-adjacent penalty in the protocol is the small liveness bond, forfeited only when a side abandons its own hand before the deal.
• H17 or S17 is pinned at the room, together with the payout table, by a rules hash the proof itself binds. The dealer cannot switch rules after your money is in, and neither can we.

What a seat actually costs

Arena's beta economics are deliberately small, fixed and fully itemized — every number below is enforced as an exact covenant output, not a menu we could edit server-side.

The full Game lock you will see on-chain is 22 KAS — 10 in stakes, 7 in bonds, 5 in reserve. It is not a 22 KAS pot; it is the sum of everything the covenant is babysitting, most of which comes straight back to its owner.

Don't trust the table — audit it

Everything above is checkable from your seat. The Verify game panel at the table shows the game identity, the pinned rules, both commitments, the deck root, the proof status and the full on-chain move log — the same facts your wallet independently verified before signing you in. After settlement, the lobby's Latest settled hands links the terminal transaction in the public Kaspa explorer: you can check with a calculator that the 22 KAS lock equals the participant outputs plus the exact fee outputs plus network fees. And if the proof, the room projection or the admission chain is ever missing or invalid, the client refuses to proceed rather than asking you to trust a server's copy.

The table itself meets you where you play. The full experience runs on a phone: the felt fills the screen, HIT and STAND sit under your thumb, and a finished hand tells you plainly what happened to your money — a signed amount, not a mood. The same proof chips are one tap away the whole time.

Blackjack is the first game, not the point

Most of what shipped today is not blackjack-specific. Under the felt sits reusable Arena infrastructure: a deterministic program generator, verified admission from room to signature, the WASM wallet boundary, the Room→Game state machine with its timeout and permissionless branches, verified terminal payouts, local and hosted proving with a GPU receipt pipeline, a fee-cap model, a byte-exact reproducible review baseline and an independent-audit methodology that put the protocol through five adversarial review rounds before a single public table opened.

On that base, the next provably fair game — dice, baccarat, a coin flip, simple card duels — costs a fraction of the first. Blackjack earned its place as the opener because it is simple enough to finish and hard enough to prove the platform: hidden dealer information, player choices, rule variants, multiple proof stages, timeouts and a terminal payout from shared funds. If Arena can referee blackjack without being trusted, the harder question — what else can run this way? — becomes an engineering backlog, not a research problem.

That is also why we call Arena the first real zk-application on Kaspa L1: it is not a proof attached to a demo, but covenants, zero-knowledge proofs, commitments, Merkle openings and wallet-side verification holding real money to real rules, in public, right now.

FAQ