I was interested in developing a generative project that would consist of lines of randomly generated text. Unlike projects that have already done something similar, this project takes it a bit further and is meant to generate fully formed sentences structured on patterns of grammar and speech.

I created a front end in react with a minting page that currently takes a dictionary of all the types of words I want to use, (prepositions, adjectives, etc) and a list of words corresponding to each, uses

"Math.floor(Math.random() * preposition/noun/verb/etc.length,"

for each word of the chosen sentence structure (also utilizing the above method for random selection) for a number of lines (also, chosen in the same Math.random() way)

The question here is, is this bad to do? I am looking to not create a giant solidity contract containing all of the words, and logic of putting it together. If the Math.random function is enough true randomness to satisfy not being exploited as it's not part of the blockchain, then is it secure enough? Can people in some way put their own information in creating whatever content they wish? The entirity of my function is performed with a single click, so I don't have to sanitize input from anyone, but I am not 100% sure if it is secure.

Below is the code for the generation

import React, { useState, useEffect } from 'react'
import { Container, Card, Row, Col, Button } from 'react-bootstrap';
import { languageParts } from '../shared/languageParts';
import { sentencePatterns } from '../shared/sentencePatterns';

const PoemGenerator = () => {

    const [pattern, setPattern] = useState('');
    const [poem, setPoem] = useState([]);

    function choosePattern() {
        let choice = Math.floor(Math.random() * 3);
        console.log("Choice: ", choice)

    function buildPoem() {
        let lines = [];
        while (lines.length < 4) {
            let currentLine = [];
            for (let i = 0; i < pattern.length; i++) {
                console.log(`Index ${i}: ${pattern[i]}`)

                const { articles, adjectives, nouns, pronouns,
                    adverbs, prepositions, verbs } = languageParts;

                switch (pattern[i]) {
                    case 'article':
                        currentLine.push(articles.beforeConsonant[Math.floor(Math.random() * articles.beforeConsonant.length)] + " ")
                    case 'adjective':
                        currentLine.push(adjectives[Math.floor(Math.random() * adjectives.length)] + " ");
                    case 'noun':
                        currentLine.push(nouns[Math.floor(Math.random() * nouns.length)] + " ");
                    case 'pronoun':
                        currentLine.push(pronouns[Math.floor(Math.random() * pronouns.length)] + " ");
                    case 'verb':
                        currentLine.push(verbs[Math.floor(Math.random() * verbs.length)] + " ");
                    case 'adverb':
                        currentLine.push(adverbs[Math.floor(Math.random() * adverbs.length)] + " ");
                    case 'preposition':
                        currentLine.push(prepositions[Math.floor(Math.random() * prepositions.length)] + " ");
                        console.log("Lol wut");

    useEffect(() => {
        if (pattern == null) {
        } else {
            console.log("Poem built")
    }, [pattern])

    return (
            <Row className='my-5' style={{ height: "70vh" }}>
                <Col sm={12} md={6}>
                    <Button onClick={choosePattern} variant='warning' size="lg">Generate</Button>
                <Col sm={12} md={6}>
                        <Card.Header>Pattern: {pattern}</Card.Header>
                                <Card.Text>Generate a poem!</Card.Text>


export default PoemGenerator;

Sample output: Output

  • Hi Yintii.eth! Welcome to Ethereum Stackexchange! I fail to see how this is related to Ethereum, perhap stackoverflow.com is a better site where to ask this type of questions.
    – Ismael
    Nov 1, 2021 at 5:42

1 Answer 1


Yes it's very bad.

Just enter this in your console / script as any user could :

Math.random = function() { return 1.0 ; }

And all randomness is gone, you could replace Math.random by anything you want.

Plus Math.random is known not to be secure, as it was never intended to be.

If as you say, the user can then mint it's generated sentence / poem, and you are planning on monetizing your NFTs then this is a critical vulnerability as rarity means close to nothing in that context.

  • Thank you for the insight. I wrote that more wondering that IF it was a true random source, would it be secure. I suppose it will end up being a fairly large couple of smart contracts then.
    – Yintii.eth
    Oct 31, 2021 at 19:18
  • The thing is, even if it was, f you leave it in user's hands you must also have a proof that the random number was generated properly. Maybe Zksnarks couls help but I'm barely understanding that concept as of now so I couldn't tell you much more , sorry :/
    – hroussille
    Oct 31, 2021 at 19:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.