I've compared the 2 versions of the Ethereum wiki page about the hard problems of cryptoeconomics:

and found that the version from 2015 has a section titled Random Number Generation:

The open-ended challenge is to come up with a mechanism inside of a cryptoeconomic context which provides random numbers as output with maximally relaxed security assumptions and maximal robustness and resilience to attackers - ideally, a mechanism with the same properties as proof of work but without (or with only a negligible fraction of) its cost.

It also mentions the "N-of-N commit-reveal, as exemplified in Tomlion's RANDAO protocol" and its limitations.

This section is missing in the latest revision of the document. Does it mean that random number generation has been solved?

  • 2
  • Nice observation but I doubt it's been solved, haven't at least seen anything like that anywhere. Who knows why the section has been removed in the newer version.... – Lauri Peltonen Feb 13 '18 at 17:57
  • @LauriPeltonen I think there are 3 options here: (1) it's been solved, (2) someone proved that it's unsolvable, (3) they forgot to include this section in newest revision. – medvedev1088 Feb 13 '18 at 17:59
  • Well the actual question isn't "is it solved or not", but more like "how good random numbers can we get without paying big". That ratio (randomness vs efficiency) is probably improving all the time - maybe it has improved enough that it's not considered as such a problem anymore? – Lauri Peltonen Feb 13 '18 at 18:09
  • @LauriPeltonen Possible. The RANDAO solution is not good enough I suspect otherwise the problem wouldn't be stated (as RANDAO itself is mentioned in that page). Do you know of anything better than RANDAO? – medvedev1088 Feb 13 '18 at 18:14

Here's a very good article on Random Number Generators (PRNG) in Ethereum Smart Contracts.

There are several implementations of pseudo PRNG that use elements like block.blockhash(block.number) like the one done by axiomzen:

function random(uint64 upper) public returns (uint64 randomNumber) {
  _seed = uint64(sha3(sha3(block.blockhash(block.number), _seed), now));
  return _seed % upper;

But these solutions are prone to predictability if given enough effort by an attacker. Here's an example of a Ethereum Roulette using this method, and how some one beat the house.

Currently the best approach is to use an external Oracle such as oraclize.

| improve this answer | |
  • 1
    Thank you for the answer. Have you seen examples of block.blockhash anywhere? I thought block.blockhash(block.number) will always return 0 because it can't return current block has. – medvedev1088 Feb 13 '18 at 19:56
  • Found the answer in the article that you linked – medvedev1088 Feb 13 '18 at 19:58
  • 3
    It's too broad to say "currently the best approach is to use an external oracle", although that's sometimes the right solution. It depends on the situation - for example, when all the parties to the contract are online at the same time you can use a commit-and-reveal process, which avoids adding a trusted-third-party security hole. See this answer for more on the subject: ethereum.stackexchange.com/questions/191/… – Edmund Edgar Feb 14 '18 at 0:39
  • 1
    The main issue with oraclize is that is not trustless, and can be subject to certain race attacks, ie if somebody "see" the oraclize transaction before it is mined it may give an advantage. – Ismael Feb 14 '18 at 3:55
  • Using an oracle such as oraclize introduces a trusted third party into the picture. To quote the oraclize documentation that you linked, the randomness comes from a "secure hardware environment provided by a Ledger Nano S." As such, there are two additional security assumptions. First, that the company producing Ledger is not acting maliciously. And second, that the secure hardware enclave works as intended. Both of these are very far from what is generally desired in decentralized blockchain settings. – dionyziz Feb 6 '19 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.