In VRFConsumerBaseV2 the fullfillRandomWords function is made internal and is called via the rawFulfillRandomWords function.

function rawFulfillRandomWords(uint256 requestId, uint256[] memory randomWords) external {
if (msg.sender != vrfCoordinator) {
  revert OnlyCoordinatorCanFulfill(msg.sender, vrfCoordinator);
fulfillRandomWords(requestId, randomWords);


The annotations in the contract says:

"A method with the ability to call your fulfillRandomness method directly could spoof a VRF response with any random value, so it's critical that it cannot be directly called by anything other than this base contract(specifically, by the VRFConsumerBase.rawFulfillRandomness method)."

I assume the difference between fulfillRandomness and fulfillRandomWord is a mistake on part of the annotators.

What is the problem if the fulfillRandomWords function is made public after we modify the function to ensure that only the VRFCordinator is able to execute the function?

1 Answer 1


In Chainlink VRF, the randomness generated by Chainlink node is sent to contract VRFCoordinator and the coordinator contract will verify if the randomness is generated with the seed and Chainlink node's private key. If the randomness is verified successfully, it will be sent to VRF consumer contract which is the contract inherited VRFConsumerBaseV2.

Because randomness can only be sent to consumer contracts after being verified by the contract VRFCoordinator, only the VRFcoordinator has permission to write the randomness to consumer contracts. So you can see there is require(msg.sender == vrfCoordinator, "Only VRFCoordinator can fulfill"); in rawFulfillRandomness.

Theoretically, you can make fulfillRandomness public and add a require statement for the VRFCoordinator. The advantage of the fulfillRandomness and rawFulfillRandomness design, IMHO, is users can separate the permission and business codes. If a new user starts using Chainlink VRF, he can directly write business codes in fulfillRandomness without knowing all details about VRFCoordinator and permission things.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.