I've seen more complicated ways for a contract to generate a random number. But the Ethereum Yellow Paper itself suggests a "trivial solution" using the BLOCKHASH opcode (see below, bold is mine).

If a contract just needs a couple of random numbers (not hundreds), how secure would this method be? What example use cases would this method be satisfactory? Which use cases are attackable in a practical way, if this method was used?

Random Numbers. Providing random numbers within a deterministic system is, naturally, an impossible task. However, we can approximate with pseudo-random numbers by utilising data which is generally unknowable at the time of transacting. Such data might include the block’s hash, the block’s timestamp and the block’s beneficiary address. In order to make it hard for malicious miner to control those values, one should use the BLOCKHASH operation in order to use hashes of the previous 256 blocks as pseudo-random numbers. For a series of such numbers a trivial solution would be to add some constant amount and hashing the result.

up vote 22 down vote accepted

Just to clarify, the "trivial solution" referred to is about how to produce a series of random numbers from a single random seed.

As a general rule, BLOCKHASH can only be safely used for a random number if the total amount of value resting on the quality of that randomness is lower than what a miner earns by mining a single block.

To see why this is the case, we can imagine the opposite situation, where a value of perhaps millions rests on the randomness obtained from a BLOCKHASH operation (for example, to select a lottery winner who will win that amount). Due to the large amount of money at stake, a well-funded attacker would have a financial incentive to buy a ticket and then generate many different alternative blocks (perhaps using millions of AWS instances for a short time period but at a substantial cost) for the block height from which the drawing is to be computed. When a block is found with a hash that will result in the miner's ticket winning, the miner then immediately mines more blocks on top of this one (to ensure it succeeds) and then submits it to the network, allowing them to guarantee themselves the prize. This operation might be very expensive, but as long as the prize is big enough it will still be a profitable attack to perform.

This is an extreme example, but the boring version of this attack where a miner just so happens to mine that one block, checks if they win, and then throws away the answer if they don't, would still be able to double their overall odds of winning and is still an "unfair" statistical manipulation, albeit a weak one. However, if throwing the block away costs more than anyone can hope to gain, it is highly unlikely that anyone will perform the attack, thus our general rule.

  • 4
    It is important to note that some people try to use a combination of randomness sources. ONLY THE LAST ONE MATTERS. Whatever piece of randomness, be it blockhash or timestamp, is added in last can break all of the randomness of the system. – Tjaden Hess Jan 23 '16 at 0:04
  • 1
    Comment to Jeff's answer. Every valid block that miner throws away, costs him 5 eth. If he has to throw away 1 000 000 valid blocks, it costs him 5 000 000 eth. If prize is 1 000 000, it makes no sense to throw away 5 000 000. If prize is 10 000 000, then it makes. – Matias Mar 15 '16 at 8:35
  • This is just the same rule applied repeatedly. If each mined block offers a "chance" or a "step", and the miner values that "chance" or "step" at more than 5 BTC, then the BLOCKHASH operation cannot be used for the application (or any other application where >5 ETH chances or steps could be part of a successful manipulation strategy). If it takes an average or total of 1,000,000 blocks to obtain a 10,000,000 reward, then there is at least 10 ETH of value resting on each block. – Jeff Coleman Mar 16 '16 at 19:45
  • 2
    Does not proof of stake drastically reduces the cost of the throwing away a block for a miner/staker? (basically to the cost of the fees + marginal fraction of compound interest for staking later) – fair glu May 12 '16 at 9:55
  • How does this answer change in the light of moving ethereum from PoW to PoS? – user1282931 Aug 26 at 5:52

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.