How Cravin Uses Provably Fair Verification in Mystery Boxes

Cravin presents its mystery boxes as cryptographically verifiable rather than purely trust-based. On its site in 2026, the platform says every box shows exact drop rates before opening, and its fairness system locks the outcome in advance using a hashed server seed, a client seed, and a nonce that users can later inspect through a verification tool. That matters because mystery-box buyers are usually asked to trust both the odds and the timing of the result. Cravin’s model is designed to let users check both.

Cravin is operated by Supabox LTD, according to the company information published on the platform’s box catalog page in 2026. The same site states that users must be over 18 and that each box lists every possible item and the exact drop rates before opening. Separately, Supabox’s public FAQ explains the mechanics behind its “Provably Fair” system in more detail, making it the clearest public description of how Cravin’s verification process appears to work.

How the hash-and-seed system creates a fixed result

Supabox says its provably fair system generates randomness before the reveal begins and then seals that result using cryptographic inputs. In its public FAQ, the company says the process starts with crypto.randomBytes(32), producing a random value that is converted into a float between 0 and 1. That number is then matched against a fixed prize table. In the example published by Supabox, values from 0.00 to 0.40 map to Prize A, 0.40 to 0.70 to Prize B, 0.70 to 0.90 to Prize C, and 0.90 to 1.00 to Prize D.

The important part is not the example prize labels but the sequence. Supabox says the outcome is sealed with three elements: a hashed server seed, a client seed from the user’s browser, and a nonce tied to the user’s unboxing count. Because the server seed is hashed before the opening and revealed afterward, the platform is claiming it cannot quietly swap the result once the animation starts. The client seed and nonce add uniqueness to each opening, so the same user does not repeatedly hit the same deterministic output.

Why published odds matter as much as the cryptography

A provably fair system verifies that a result was not altered after being committed. It does not, by itself, tell users whether the prize distribution is generous or poor. That is why Cravin’s separate claim about visible drop tables is central. On its box catalog page, Cravin says each box lists every possible item and the exact drop rates before opening. Its blog repeats that legitimate platforms should publish item distributions and retail values in advance.

That distinction is critical for users evaluating fairness. Cryptographic verification answers one question: was this specific opening tampered with? Published odds answer another: what were my chances before I clicked? A platform can be cryptographically consistent and still offer unattractive probabilities. Cravin’s public materials try to address both sides by pairing pre-disclosed drop rates with post-opening verification.

Cravin also says every box guarantees at least the value of the purchase in items and credits combined. That claim appears on the company’s box catalog page and is repeated in its blog. While that is separate from provably fair verification, it changes how users interpret the prize table because the platform is saying the floor value is structurally protected rather than left entirely to chance.

What users can actually verify after an opening

According to Supabox’s FAQ, users can go to their unboxing history and find four pieces of information: the server seed and its hash, the client seed, the nonce, and a link to verify the result. The company says no coding knowledge is required. In practical terms, that means the user should be able to compare the revealed server seed against the earlier hash and confirm that the same inputs reproduce the recorded outcome.

This is the core of the “provably fair” claim. If the revealed seed matches the pre-shared hash, the platform has evidence that it did not replace the seed after seeing the result. If the client seed and nonce also match the recorded opening, the user can test whether the output corresponds to the published verification logic. That is stronger than a standard retail mystery-box model, where the buyer usually has no way to audit the draw at all.

What Cravin’s model solves, and what it does not

Cravin’s public documentation addresses two common complaints in online mystery boxes: hidden probabilities and unverifiable outcomes. By publishing exact drop rates and describing a seed-based verification system, the platform gives users more information than a conventional blind sale. The company also publishes its operator name, Supabox LTD, and a Cyprus address on the site, which adds a layer of corporate identification that many low-transparency box sites do not provide.

Still, there are limits to what public verification can prove. Users can verify that a committed result was not changed after the fact, but they are still relying on the platform’s implementation of the system and on the accuracy of the published prize table. Cravin’s own blog says third-party audits would provide stronger assurance than self-implemented systems. As of the public pages reviewed on March 26, 2026, Cravin prominently describes provably fair verification and visible odds, but the strongest publicly accessible technical detail comes from Supabox’s FAQ rather than from a standalone technical audit page.

That leaves Cravin in a middle position familiar across the mystery-box sector: more transparent than opaque platforms, but still dependent on users checking the disclosed data and understanding what the cryptography does and does not guarantee.

Frequently Asked Questions