Gambling dApps: How Decentralized Casinos Work, What Can Go Wrong, and Whether US Players Can Use Them
A gambling dApp replaces the casino company with a smart contract. That removes some risks and creates new ones. Here is how they work, how to check one, and where they stand under US law.
By Giuseppe Vivarelli · Checked November 4, 2026 · Sources at the end
- A gambling dApp is a smart contract that takes bets from your wallet and pays out automatically, with no account and usually no ID check.
- Fairness depends on the randomness. Block-hash randomness can be manipulated; commit-reveal and VRF with on-chain proof are far stronger.
- No US state licenses decentralized casinos. If the contract fails, nobody has to refund you.
How a gambling dApp works
One bet, from your wallet to the payout
You open the dApp's website and connect a wallet such as MetaMask. You do not create an account or send ID.
Your bet is a blockchain transaction to the game's smart contract. You also pay a network fee (gas).
The contract gets a random number from block data, a commit-reveal scheme or an oracle such as a VRF.
If you win, the contract sends the payout straight to your wallet. Everything is public on the blockchain.
dApp casino vs crypto casino vs licensed US casino
| Gambling dApp | Offshore crypto casino | State-licensed US casino | |
|---|---|---|---|
| Who holds your money | A smart contract | The casino company | The licensed operator, under state rules |
| Identity check | Usually none | Often before the first withdrawal | Always (age and location) |
| Who can block a payout | Nobody, unless the contract has admin keys or bugs | The casino | The operator, with a regulator to complain to |
| Fairness check | Read the contract and its randomness source | "Provably fair" seeds on some games; otherwise trust | Independent lab testing required by the state |
| If something goes wrong | No one to refund you | Offshore complaint, rarely enforceable | State regulator |
| US legal status | Not licensed by any US state | Not licensed by any US state | Legal in the states that license it |
Randomness: the part that decides if a dApp is fair
Block hashes: weak
Some contracts use the hash of a block as the random number. The miners or validators who produce blocks can see it first and can choose not to publish a block that makes them lose. If the prize is big enough, that bias pays off for them and costs the players.
Commit-reveal: better
The game publishes the hash of a secret number before you bet, then reveals the number. The contract only accepts it if it matches the earlier hash, so the operator cannot change the number after seeing your bet. The result is often mixed with block data, so some block-producer influence remains.
VRF with on-chain proof: strongest of the three
With a verifiable random function, an oracle produces the random number together with a cryptographic proof, and the proof is checked on-chain before the contract can use the result. A faulty oracle can refuse to answer, but it cannot deliver a biased number that passes the check.
Academic work on smart-contract casinos goes further: even a "provably fair" contract can be gamed by an attacker with enough money and computing power if it is set up badly.
The real risks
A bug in the code can drain the bankroll or lock your funds. There is no company that has to make you whole.
Many "decentralized" games keep an owner key that can pause the contract, change odds or withdraw the bankroll.
The website is not the contract. Clone sites copy the interface and point your wallet at a different contract.
Gas can eat small bets: one documented example paid $0.78 in fees on a $2.50 wager.
Every bet sits on the blockchain forever. Anyone who links your wallet to you can see how you gamble.
No US state licenses these games, so there is no regulator to complain to and no dispute process.
Checklist before you connect a wallet
- Find the official contract address from more than one source and check that the site's transactions go to it.
- Check that the contract is verified (source code published) on a block explorer.
- Look for a published security audit, and read what it says was found, not only the logo.
- Find the randomness source: block hash (weak), commit-reveal (better) or VRF with on-chain proof (strongest).
- Check for owner or admin functions that can pause the contract, change payouts or withdraw the bankroll.
- Check that the bankroll in the contract can cover a win of the size you are betting for.
- Use a separate wallet holding only what you can afford to lose, and revoke the token approvals afterwards.
- Check the law where you live first: state-by-state guide.
Where dApps stand under US law
Gambling is regulated state by state. Online casino games are legal in only seven states (Connecticut, Delaware, Michigan, New Jersey, Pennsylvania, Rhode Island and West Virginia), and only with operators those states license. A smart contract cannot hold a state licence, so a dApp casino is unlicensed everywhere in the US. In Washington, unlicensed online gambling is a felony.
Prediction markets are the closest regulated cousin. Polymarket, the best-known on-chain prediction market, settled with the CFTC in 2022 ($1.4 million penalty) and agreed to block US users from its main platform. It returned to the US in December 2025 with a limited, waitlist app through a CFTC-regulated exchange. As of April 2026 it was still seeking approval to reopen its main platform to Americans.
Prefer a casino you can hold to account?
The best-scored crypto casinos I review with no player flags. They are not dApps: they are offshore companies that accept crypto, so they are not licensed by US states either.
- BovadaCrypto about 1 hour after approval (Bitcoin up to 24 hours)80
- Ignition CasinoCrypto up to 24 hours72
- Slotland CasinoCrypto up to 24 hours71
- Winaday CasinoCrypto up to 24 hours68
- FoxSlots CasinoCrypto stated within 1-2 hours65
All crypto casinos, coins and payout times → · Verify a provably fair bet → · Prediction markets by state →
Questions
What is a gambling dApp?
A gambling dApp (decentralized application) is a casino game or betting market that runs as a smart contract on a blockchain. You connect a crypto wallet, the contract takes your bet, decides the result with on-chain randomness and pays out automatically. There is no account, and usually no identity check.
Are gambling dApps legal in the US?
No US state licenses decentralized casinos. Online casino gambling is legal only in a few states, and only with state-licensed operators. Using an unlicensed dApp does not make it legal where you live, and in Washington unlicensed online gambling is a felony. See the state-by-state guide. Not legal advice.
Are gambling dApps provably fair?
Only if the randomness cannot be manipulated. Results based on block hashes can be biased by the miners or validators who produce the blocks. Commit-reveal schemes and verifiable random functions (VRF), where a cryptographic proof is checked on-chain before the result is used, are much stronger. Read the contract to see which method it uses.
What is the difference between a dApp casino and a crypto casino?
A crypto casino is a normal company that accepts crypto: it holds your balance, can ask for ID and decides when to pay. A dApp casino holds the bankroll in a smart contract and pays automatically, but no company or regulator stands behind it if the contract has a bug.
Is Polymarket a gambling dApp?
Polymarket is an on-chain prediction market. In 2022 it settled with the CFTC and paid a $1.4 million penalty. It agreed to keep US users off its main platform. In December 2025 it launched a separate, limited US app through a CFTC-regulated exchange. As of April 2026 its main platform was still closed to Americans.
Sources
- State of the DApps, "Why are gambling dApps so popular and how do they actually work?" (33% of dApp ETH volume, May 2019; commit-reveal; $0.78 gas example)
- Chainlink, "Chainlink VRF: On-Chain Verifiable Randomness" (block-hash manipulation; proof verified on-chain)
- Ledger journal, "Gaming Self-Contained Provably Fair Smart Contract Casinos" (2016)
- Cointelegraph, Polymarket seeks CFTC approval for its main platform (April 29, 2026)
- US state status: my state guides, checked against state regulators.
Who wrote this and how
Editor of GamblingAppsStore, former senior iGaming analyst and affiliate marketer, based in Lugano. I cover crypto payments and new gambling formats for US players.
- Published method. One formula for every operator: how I score.
- Dated sources. Every figure has a source and a check date; what I cannot verify is marked "not verified".
- Independence. Affiliate commissions never change a score; flagged operators get no affiliate link. Editorial policy.
- Corrections. Found an error? Tell me with a source and I will fix it.
21+ only (18+ where permitted). Gambling involves risk; offshore operators are not licensed by US state regulators. Free, confidential help 24/7: call or text 1-800-MY-RESET. Not legal or financial advice.