Randomness in Proof of Stake

Question

The new Proof of Stake chain modifies the old DIFFICULTY opcode to be PREVRANDAO and changes its semantics (https://eips.ethereum.org/EIPS/eip-4399).

How does the new opcode compare to the old opcode in terms of on-chain randomness? Is it less easy to manipulate by various parties somehow? Is it better in some way, or worse?

Bottom line: should we use it for randomness?

Answer 1

The opcode PREVRANDAO should not be used as a source for true randomness because it's not truly random. Validators who are chosen to propose new blocks can know the value of the PREVRANDAO opcode by calculating the pseudo-random value using the same logic from that of the developer's smart contract. If the security of a contract relies on a truly random number, then an oracle service such as Chainlink VRF should be used to pull that data on-chain.

See:

https://blog.zellic.io/2022/07/07/eth2-proof-of-stake-developer-guide/

https://mvpworkshop.co/blog/ethereum-merge-everything-you-need-to-know/#DIFFICULTY_opcode_is_now_PREVRANDAO

Answer 2

1. In its current state it probably shouldn't be used, as it doesn't even allow to set an exact future prevrandao value, resulting in a lot of potential influence from validators.
2. In the future there will likely be a prevrandao(blocknumber) opcode. This would help a lot, especially when the future block is sufficiently far in the future.
3. Even further in the future Ethereum might add support for Verifiable Delay Functions (VDFs) which would remove the validator biasability of the randomness completely.

I'm talking about the technical details of Randao and its implications in more depths at https://soliditydeveloper.com/prevrandao if you're interested.