Proof
Check a lotto draw yourself
A lotto fee module picks its winner on-chain, from the block's own randomness. Nothing is drawn on a server. Every input is public, so anyone can recompute the result: this page does it in your browser and shows its work.
Formula
The module hashes the block's randomness, the block number, its own address and how many rounds it had already paid, then takes that number modulo the candidate count. The candidate list travels in the transaction that paid the round, so every input can be read back from the chain.
index = uint256(keccak256(abi.encode(blockhash(committedAt + 1), vault, rounds))) % candidates.length
No lotto round has been paid yet.