uint private seed;

// starts from 0 (including) to _length number (excluding)
function random(uint _length) private returns(uint) {
    seed = seed.add(block.timestamp.add(uint(msg.sender)));
    return uint(sha256(toBytes(uint(blockhash(block.number - 1)) + seed))) % _length;

function toBytes(uint256 x) private pure returns(bytes b) {
    b = new bytes(32);
    assembly {
        mstore(add(b, 32), x)

How safe is this to be used for generating a random number?

I have a seed in there based on the previous generated random number which would make it pretty much impossible to track.

will this be expensive in terms of gas usage?

  • As a rule of thumb: if there's a big enough monetary gain all such preudo-random number generators will be cracked – Lauri Peltonen Nov 11 at 10:20
  • @LauriPeltonen i can't see how it could be cracked, there is no way to find the seed, it's just based the previous generated number which that previous number is also based on it previous and so on. enlighten me if i'm missing something here – Adrin Nov 11 at 10:27
  • From security point of view the seed is rather pointless if used across different transactions because then everyone sees the seed and they can just factor that data in their abuse. So if an attacker wants to game the system they influence some of the input data in a way which benefits them - factoring in all the rest of the pseudo-random input such as the seed. – Lauri Peltonen Nov 11 at 10:38

This random number generator could easily be manipulated by miners. When constructing next block to be mined, the miner may freely choose set of transactions to be included, and may place the transactions in arbitrary order. Also, the miner may adjust block timestamp and probably some other block attributes. By playing with these possibilities, the miner may construct many different candidate blocks with different hashes, and they proceed with the candidate where generated random number is good for the miner.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.