Verifiable Giveaway Protocol

Phase 1 — Input normalization

Collect the canonical set: (a) source post URL, (b) fetched comment list sorted alphabetically by lowercased username, (c) draw timestamp in ISO-8601 UTC, (d) winner count N, (e) any exclusion list also sorted lowercased.

input = {
  post_url:    "https://www.instagram.com/p/<shortcode>/",
  comments:    sorted([c.lower() for c in comments]),
  timestamp:   "2026-06-10T14:23:45.000Z",
  winner_count: 1,
  exclusions:   sorted([e.lower() for e in exclusions]),
}

Phase 2 — Seed derivation

Concatenate the JSON-canonical serialization of input and feed it to SHA-256. Take the resulting 256-bit hash as the seed of a deterministic CSPRNG (HMAC-DRBG with SHA-256). Use the DRBG to produce a uniform-random permutation of the comment list (Fisher-Yates). Take the first N entries (after applying exclusions) as winners.

seed_hex = SHA256(canonical_json(input)).hex()
drbg     = HMAC_DRBG(seed=seed_hex)
shuffled = fisher_yates(input.comments, drbg)
winners  = [c for c in shuffled if c not in input.exclusions][:N]

Phase 3 — Publication

Publish the seed_hex, the canonical JSON, and the winners. Anyone can re-run Phase 1+2 from the published JSON and verify the same seed_hex + same winners. A mismatch proves the host tampered with the published winner list.

GET /api/verify/{seed_hex}
→ 200 { canonical_json, winners, verified: true }