Would a function such as the following:

function random(bytes32 seed) internal returns (uint) { 
  return uint(keccak256(abi.encodePacked(now, msg.sender.balance, nonce, block.coinbase, gasleft(), blockhash(block.number - 1), seed))) % 99; }

would such a function be vulnerable to RNG attacks on a DPoS network such as Tron? if so how?

  • What do you mean "vulnerable?" What assumptions are you making about the seed? Whoever controls the seed can make the result whatever they want. – Tjaden Hess Apr 8 '19 at 23:24
  • The seed is user provided. and can be ignored. It does not have any impact. I blocked all other contracts from calling that RNG function meaning other contracts can not interact with this function. I don’t want users to influence the outcome. All the parameters to generate random number can be predicted and thus we can guess the random number. Especially if we use a very powerful computer to pre-calculate the RNG and send transaction in mili seconds to win all the time – NowsyMe Apr 9 '19 at 0:20

I'd assume that some parameters like block.coinbase cannot be easily manipulated in PoS or similar, because you will lose your turn.

But the block timestamp now is controlled by miners/validator. Since it cannot vary too much, likely it cannot be manipulated enough to make them win, but it surely can be manipulated to make the user not win. Some kind of Denial of Service.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.