How to Audit a Casino On-Chain: Wallets, Contracts, Payouts
You do not need the operator's permission to audit an on-chain casino. If the contracts and wallets are public, the blockchain is a permanent, uncensorable audit log that anyone can read. This is the walkthrough: where to find the addresses, what to look at on the explorer, and what honest activity actually looks like.
Browse the games →Step 1: find the published addresses
Every audit starts with an address, and a serious on-chain casino hands them to you. Look for a contracts or transparency page listing the game contracts, the house wallets, and the commitment objects. Llamabet lists every contract and wallet address at /contracts, each with a direct explorer link, so there is no scavenger hunt. If a casino claims to be on-chain but publishes no addresses, the audit ends there — 'on-chain' without addresses is a slogan. Once you have the list, save it. You will cross-reference these addresses against every transaction you inspect, and against the addresses the site actually asks your wallet to interact with when you play. A mismatch between the published addresses and the ones in your transaction prompts is itself a finding.
Step 2: read the explorer like an auditor
Open each address on a Sui explorer and look at three things. First, object history: when was the contract published, has it been upgraded, and do the objects it created still exist? A contract published last week supporting a casino that claims years of operation is a contradiction. Second, transaction volume and cadence: an active casino produces a steady heartbeat of transactions — bets, payouts, commitments — not a burst of activity around launch followed by silence. Third, counterparties: are transactions flowing between the house and hundreds of distinct player addresses, or is the volume a loop between a handful of wallets? Wash activity between related addresses is the on-chain equivalent of fake reviews, and it is usually visible to anyone who sorts by counterparty.
Step 3: verify the fairness commitments exist
A provably-fair casino should be leaving a paper trail of commitments on-chain, recorded before play. On Llamabet, the rotating server seed is hashed and the hash is published to Sui as a BLS-signed, frozen ServerHashObject — frozen meaning the object is immutable from the moment it is created. Your job as auditor is to confirm these objects actually exist and keep appearing: find recent commitment objects in the contract's history, check their timestamps precede the games they cover, and confirm the cadence is regular. A casino whose last commitment is weeks old while games continue is running on trust, not proof. This is the single most load-bearing check in the whole audit, because the pre-bet commitment is what makes every downstream fairness claim falsifiable.
Step 4: follow the payouts
Solvency and willingness to pay are visible on-chain. Trace outbound transactions from the house wallets: do they flow regularly to many distinct player addresses in amounts consistent with game wins? Healthy payout patterns look organic — irregular sizes, continuous timing, wide distribution. Warning patterns include long gaps in outbound flow while inbound deposits continue, payouts concentrated to a few addresses, or a house balance trending toward zero while liabilities presumably grow. You can also test it directly: deposit the minimum, play, win or lose, withdraw, and confirm your own withdrawal lands as a real on-chain transaction within seconds. On Sui, finality is sub-second, so 'processing delays' on an allegedly on-chain withdrawal deserve skepticism.
Red flags in on-chain patterns
The chain records everything, including the embarrassing parts. Watch for: contracts with upgrade authority that could silently change game logic, held by a single key; house wallets that periodically drain to fresh unlabeled addresses, which can precede an exit; commitment objects that appear after game timestamps rather than before; volume dominated by self-dealing loops; and a mismatch between the scale the casino advertises and the scale the chain shows. None of these is automatically damning — treasuries get restructured, contracts get legitimately upgraded — but each one converts 'verified' back into 'trust me', and the whole point of an on-chain casino is to need as little 'trust me' as possible.
The limits of on-chain auditing
Be honest about what the explorer cannot show you. Most real-time casino engines run off-chain, because dealing cards and resolving hands at interactive speed on-chain is impractical. That means the shuffle itself happens on a server you cannot inspect. The bridge across that gap is commit-reveal: the server commits to its seed on-chain before play, then reveals it after, and you recompute the deck yourself. On-chain auditing verifies the commitments exist and the money flows; the reveal-and-recompute step verifies the game logic honored them. You need both. An operator can also be fully honest on-chain and still fail you off-chain — bad support, frozen accounts, sloppy security — so the explorer is a necessary check, not a sufficient one.
Why publishing addresses is a self-selecting signal
Here is the game-theoretic punchline: a casino that publishes its addresses is volunteering for permanent surveillance. Every payout skipped, every commitment missed, every drained wallet becomes public evidence that anyone can find forever. Dishonest operators rationally avoid that exposure, which means the set of casinos that publish everything skews heavily toward the ones with nothing to hide. It is not proof of honesty — you still run the audit — but it inverts the default. At Llamabet, the addresses at /contracts, the frozen commitments on Sui, and the verifier at /poker/verify exist precisely so that the audit described in this article takes you minutes instead of being impossible. Start with 1 SUI, the minimum bet, and check everything yourself.
Frequently asked questions
How do I check a casino's smart contract on a blockchain explorer?
Get the contract address from the casino's published contracts page, open it in an explorer, and review its publish date, upgrade history, created objects and transaction flow. You are looking for a real operating heartbeat: regular commitments, payouts to many distinct player addresses, and history consistent with the casino's claims.
Can you tell if a crypto casino is solvent from on-chain data?
Partially. You can see house wallet balances and whether payouts flow regularly to players, which catches the worst cases — draining treasuries, halted withdrawals, self-dealing loops. You cannot see off-chain liabilities, so treat healthy on-chain flow as strong but not conclusive evidence.
What does a fairness commitment look like on-chain?
On Llamabet it is a frozen object on Sui containing the SHA-256 hash of the server seed, BLS-signed by the house and recorded before play. Frozen objects are immutable, so the timestamp proves the house locked in its seed before seeing any bets. You verify by checking these objects exist, predate the games, and match the seeds revealed afterward.