generation random number

Question

uint private seed;

// starts from 0 (including) to _length number (excluding)
function random(uint _length) private returns(uint) {
    seed = seed.add(block.timestamp.add(uint(msg.sender)));
    return uint(sha256(toBytes(uint(blockhash(block.number - 1)) + seed))) % _length;
}

function toBytes(uint256 x) private pure returns(bytes b) {
    b = new bytes(32);
    assembly {
        mstore(add(b, 32), x)
    }
}

How safe is this to be used for generating a random number?

I have a seed in there based on the previous generated random number which would make it pretty much impossible to track.

will this be expensive in terms of gas usage?

Answer 1

How safe is this to be used for generating a random number?

Close to zero.

• As answered by Mikhail: miners can manipulate it
• It's still low safety without considering miners. There isn't much randomness in the implementation.
  1. Given a block and a length, the result is deterministic.
  2. Therefore, if the return result is used for activities like lottery, and suppose the usage is something like

function try_my_luck() {
    r=random(some_len)
    if r < 0.01 {
       award(100Eth)
    }
}

3. Then because it's doesn't cost too much gas to call your random function, a straightforward attack is

function attack() {
    r = random(some_len)
    if r >= 0.01 {
        revert; // will be back and try another block
    }
    for i = 0; i < 100000; i++ {
        try_my_luck()
    }
}

4. A real-life example is here.

---

[Edit] One might argue that it's pretty hard to enumerate the combination of

• length
• sender address
• block time
• block number

However,

• length - it probably is the length of some array in your contract
• sender address - easy to generate and retry
• block time - only in seconds precision, easy to guess
• block number - pretty much deterministic

When then incentive is great enough, it's not that difficult to do off-line computation to generate an optimal combination of these values.

Answer 2

This random number generator could easily be manipulated by miners. When constructing next block to be mined, the miner may freely choose set of transactions to be included, and may place the transactions in arbitrary order. Also, the miner may adjust block timestamp and probably some other block attributes. By playing with these possibilities, the miner may construct many different candidate blocks with different hashes, and they proceed with the candidate where generated random number is good for the miner.