Odds disclosure

How odds work

• Core

  The most common tier: the lowest-value items in a box.

• Select

  Less common, higher value.

• Rare

  Uncommon pieces well above the box price.

• Grail

  The rarest and most valuable items in a box.

• Every item in a box (a watch or a purse) has its own published chance and a fixed tier, from Core (most common) to Grail (rarest). The tier odds shown on a box are the sum of the chances of the items in that tier; tiers with no items in a box aren't shown.
• Every item's chance is published on the box page before you open, and the chances in a box add up to exactly 100%.
• A box's contents and odds belong to an edition. Once an edition is published its odds are locked and never change while it's on sale. To change what's in a box we publish a new edition, and the box page shows its edition number.
• A box can only be opened while every item in it is in stock, so every listed item can actually be won.
• Opening three watch boxes at once makes three independent draws at the same odds. Purse boxes open one at a time.
• Odds tell you how likely each item is, not what it's worth to you. Item values are estimates. Selling an item back pays 90% of its estimated value, and items can be held for 30 days before they must be shipped or are sold back automatically. The item you get may be worth less than the price of the box.

How every draw is made and checked

Results are drawn on our servers, never in your browser; the opening animation only shows the result the server already drew. We use a provably fair commit–reveal method, so you can check that we didn't pick your result after the fact.

1. Commit. Before you open anything, we generate a secret server seed for your account and show you its SHA-256 hash. The hash locks the seed in without revealing it.
2. Draw. Each opening uses your client seed and a nonce that goes up by one with every draw. We compute HMAC-SHA256 with the server seed as the key and client_seed:nonce as the message.
3. Roll. The first 52 bits of that digest (its first 13 hex characters), divided by 2⁵² and multiplied by 1,000,000, rounded down, give a roll from 0 to 999,999.
4. Pick. The edition's items, in order of their item ID, each cover a range of the roll space equal to their chance × 10,000 (so a 0.25% item covers 2,500 numbers). The item whose range contains the roll is the one you get.
5. Reveal. Each item in your collection shows the seed hash, client seed, nonce and roll used. When you start a new seed pair, we reveal the old server seed so you can recompute every roll made with it, and commit to a new one.

digest = HMAC_SHA256(key = server_seed, message = client_seed + ":" + nonce)
roll   = floor(int(digest[0:13], 16) / 2^52 × 1,000,000)
item   = first item (by ID) where roll < running total of chance × 10,000

You can find the proof for any draw on the item's page in your collection.