Good news first - the recently discovered issue that contents of unopened booster pack contents were visible has been fixed for future packs. You can't be sure that the owners of already existing packs didn't peek, but for those they buy now they're in the dark (assuming no one reverse engineered the algorithm, and there's no other holes).
Now if you clicked the link for the fix, and read the conversation below, there's another issue popping up on my radar. Let me explain my thoughts over the last 24 hours here.
To me, the main promise behind having my cards on the blockchain is the immutable verification who owns which cards. If there's any kind of dispute, I want to be able to trace the movement of each single BCX (level 1 card) from when it came into existence until now. And I want to be able to do this in the future, no matter what happens to the entity which initially issued the cards.
The original idea for Steemmonsters to achieve this was to use an algorithm which issues booster packs in a reproducible way and publish this algorithm. It was discovered that this leads to a couple of problems though.
Firstly, the now fixed peeking into packs of course. The algorithm was depublished and changed, contents of a pack should now be hidden in the database of Steemmonsters.
And there's another initial design decision which, while understandable due to RC limitations, now leads to problems.
You don't need to tell the blockchain when you open a pack. And it also doesn't trigger any transaction from steemmonsters. While they add a history entry to their own database, the blockchain is blind to it.
Now that we do not know the algorithm, and the information about the contents of the boosters gone too, I honestly have to admit I feel a bit robbed. The proof of ownership doesn't happen on the blockchain, but I have to access the third party steemmonsters api. If that disappears and they don't publish something post mortem, my property is gone.
said they're hiring to work on this topic, and I really hope they get a solution worked out in a timely manner. They're the authority, and we all trust them to not get in the way of the distribution algorithm, so it's okay to me that they keep the booster contents a dark hole - the algorithm can be published a while after the cards sold out, maybe with a large grace period for resellers and a subsequent force opening or so, whatever.
I want them to tell the world which cards I drew though!
We don't need smart contracts, where everyone has to interact on the blockchain and every steem node has to calculate the results. That's too expensive anyway. (For the fees the user needs to pay to miners to "activate" a single Gods Unchained (ref link) card so it's available as a token you can buy a common card on steemmonsters from another player.)
What we need is a protocol everyone agrees on how to get cards known to the blockchain and make it possible to track them on it.
My suggestion (and I foolishly just assumed it would be implemented that way) would be that, for the start, steemmonsters as the issuers of the (first sets of) cards keep track about that. We have to trust them to not screw us with their cards anyway, and as long as they find a way to prove in hindsight that everything was correct that's fine with me.
But as this will probably take some more time, I hacked a small service today. Transfer 0.01+ STEEM or SBD to without a memo to make it publish custom_json transactions, listing all your current cards (see https://steemd.com/@monsterverify). The data comes from the steemmonsters API, I only remove a few redundand fields and write everything important on the chain. The process takes a minute or two to complete, depending on the size of your collection.
If you use it once all your cards have been mentioned on the blockchain. Unless you open new boosters or someone transfers an unregistered card to you there is no need to use it again.
Maybe over time the already trusted accounts will pick up and offer more fine tuned services (putting data on the chain automatically), but for now it will work to have a mention, and this way something like a rudimentary token on chain.