My fear would be that others could game this system to allow them to know when to buy a pack vs not buy a pack and thus game the system that way.
This is exactly why I have yet to release the code. Once I have a good system in place that I am certain cannot be gamed then I will release that portion of the code so that the game can be fully decentralized.
I'll definitely be following your updates on it! My initial thought was just hash the payment tx against the following block (since 3 second tx wouldn't make the end user wait too long) but then my fear was that would leave BP witnesses with a potential attack vector. I'm 100% confident you'll have the right answer though!
muy buena propuesta
I think it is going to be very hard to find a good solution for this particular problem. Verifiable code execution is a really hard problem, especially when dealing with random numbers. Using the blockchain as a source of randomness is probably not a good solution, since to be truly trust less, you would have to also post the code for generating the randomness from the blockchain, and anyone could again game it.
Maybe You could look into snarks, or starks.