Seller → Car Lotto → Entrants → Winner

For entrants

1. 1

   Pick a car

   Every listing shows the entry price, maximum entries, entries sold and closing date. The maximum never changes once a competition is live.

2. 2

   Enter

   Choose how many entries you want. Where the rules require it, answer the competition question, then pay securely by card. Entries are only issued once our payment provider confirms the payment directly with our servers.

3. 3

   Get your entry numbers

   You'll see them on screen, by email and in My Entries. Numbers run sequentially from #1 and can never be changed or reissued.

4. 4

   The draw

   After the competition closes, the result is drawn and published using the process below.

For sellers

Enter your registration, describe the car, upload guided photos and your documents, and tell us what you’d like to receive. Our team verifies your identity, ownership, finance position, vehicle data, condition and value. We then send a proposal with an agreed payout. Car Lotto sets the competition structure: entry price, maximum entries and dates. Nothing goes live until you accept. Your payout is released once the winner is verified and the car has been handed over.

How draws are verified

Car Lotto uses a commit–reveal draw (method COMMIT_REVEAL_HMAC_SHA256_V1). Nobody, including Car Lotto staff, can influence or re-roll the result without it showing on the public record.

1. Freeze. When the competition closes, every valid entry is listed in entry-number order. We publish the SHA-256 pool hash of that list and the downloadable pool file.
2. Commit. A secret 32-byte random seed is generated on our servers. We publish its SHA-256 hash (the commitment) before the draw runs. The seed can’t be changed after this without breaking the commitment.
3. Draw. The winning position is HMAC-SHA256(seed, poolHash | counter) modulo the pool size, using rejection sampling so every entry has exactly the same chance.
4. Reveal & verify. We publish the seed. A second authorised team member independently recomputes the result before it’s announced. Anyone can check that the seed matches the commitment, the pool matches its hash, and the calculation gives the same winning entry.
5. Permanent record. Pool and commitment are locked at database level. If a draw ever had to be voided (for example, an ineligible winner), the voided draw stays on the public record next to the new one.

Rules and responsible participation

Each competition’s eligibility, entry routes, limits and closing conditions are set out on its page and in the competition rules. Please set a budget and read our responsible participation guidance.