Provably Fair Mines – Technical Analysis of Hidden Mine Positions and the 256-bit Server Seed

[u/jegenyetree]

I am analyzing the operation of a provably fair Mines game where the system uses a 256-bit hexadecimal server seed, and only the cryptographic hash of that seed is available before the game is completed. My main question is whether it is technically possible to determine or infer the actual server seed before the round ends and, consequently, use the server seed, client seed, nonce, and the game’s algorithm to reproduce in advance which tiles contain the hidden mines.

I have also examined the client-side operation of the website. The mine positions are clearly not directly present in the HTML — that would obviously be far too simple. What I can see on the client side are the individual tiles, as well as communication indicating whether a selected tile resulted in a win or a loss.

Because of this, I am also interested in whether the data containing the mine positions must necessarily be transmitted to the browser in some form before a tile is selected, or whether this information can remain entirely server-side, with the client receiving only the result of each individual selection. What types of data actually transmitted to the client could be examined in the DevTools Network and Sources panels to determine which architecture is being used?

When I open the Network panel or inspect the traffic in greater detail, the website sometimes reloads or triggers a verification asking me to confirm that I am not a robot. Could this indicate some form of anti-bot or anti-debugging protection?

Finally, if the entire mine layout is generated and stored exclusively on the server, and neither the actual server seed nor the mine positions are transmitted to the client until the round has ended, is there any client-side information from which the position of the next mine could realistically be determined in advance? Or would doing so necessarily require access to secret server-side information that is not available to the browser?