To emphasise, I’m solely interested in blocks prior to the transition to PoS.

Given that a miner making any change to the block header would have resulted in a completely different hash, my thinking is that a miner would have been able to iterate through a very large amount of block hashes in a very short period of time to get a significant amount of target values (let’s say, greater 4 or 5 hexadecimal numbers).

Yet there’s evidence to suggest this wasn’t the case.

  1. While core devs have never suggested that using block hashes as a form of entropy was ever completely secure, they stated that the transition to PoS made it even more insecure (which makes sense as there’s no extensive work to complete for the block reward), meaning that at some point it had some level of security. See discussion here: https://ethereum-magicians.org/t/eip-4399-supplant-difficulty-opcode-with-random/7368/6.

  2. Many applications were using future block hashes for some secure purpose, including Binance which held multiple block hash lotteries worth hundreds of thousands of dollars at the time. Example: https://www.binance.com/en/support/announcement/ethereum-block-hash-lottery-win-up-to-10-000-busd-8f64da1a541946d798c5831762d990c5. Were these applications just completely insecure?

Does the suggestion by the protocol core devs that it had some level of security prior to the transition to PoS simply come down to the fact that wasting resources trying to produce a specific block hash would have resulted in the miner being out-raced by other miners? Or was there something more to this?

1 Answer 1


The security was partially given by the cost of renting the mining equiment. The expected benefit has to be greater than the costs of mining blocks for the attack to be worth.

The EthPow algorithm has a "dificulty" parameter that will adjust dynamically so the whole network will find a block each 12 seconds. For an attack to be successful it required significant resources.

  • Right, but Binance was holding block hash lotteries worth hundreds of thousands of dollars each, and I’ve heard lotteries around the same time with smart contracts using this method worth millions. I wonder how many of them were gamed by miners that went undetected. It would be a hard thing to establish either way.
    – user72364
    Oct 10, 2023 at 3:13
  • @user72364 IMHO the possible attacks were more theoretical, not feasible in practice. There were easier targets, so not worth the investment.
    – Ismael
    Oct 10, 2023 at 4:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.