3

My team is writing a discord lottery bot, we want to use the block hash of some block in the future as a seed for the random generator.

We want to allow lottery participants to independently verify that our lottery is fair because they could know in advance what block we will use for the randomness.

Do you think it will work in our case (is it secure to use it as randomness source this way)? Thx!

2
+50

It would be better if we use Smart Contract Toolkits such as Verifiable Delay Function (VDF) from StarkWare Veedo Random Generator or ChainLink Verifiable Random Functions (VRF) instead of the simple block hash as the source of randomness. In the case of ChainLink VRF it is possible to use the VRF in a distributed network setting itself. With every new request for randomness, Chainlink VRF generates a random number and cryptographic proof of how that number was determined. The proof is published and verified on-chain before it can be used by any consuming applications. This process ensures that the results cannot be tampered with nor manipulated by anyone, including oracle operators, miners, users and even smart contract developers.

6

we want to use the block hash of some block in the future as a seed for the random generator.

I think using a future block hash is generally considered "safe". (This article discusses using future block hashes, though on-chain inside contracts. I can't see how off-chain would be any less safe: https://blog.positive.com/predicting-random-numbers-in-ethereum-smart-contracts-e5358c6b8620)

We want to allow lottery participants to independently verify that our lottery is fair because they could know in advance what block we will use for the randomness.

Might depend on what you're doing with the seed afterwards :-)

enter image description here

Not sure anyone here will know enough about PRNG to say whether or not such a 32-byte number satisfies the various NIST statistical tests for PRNG.

It might be worth asking the right people on the Stack Exchange Cryptrography site: https://crypto.stackexchange.com/

1
  • 1
    thx!, and nice meme :) You never know... Mar 20 at 23:29
0

The most often raised issue with using the block hash as a source of randomness is miner attacks. If sufficiently incentivized, a miner can see if a potential block is profitable for them or not. Here's some good reading on the topic:

That being said, if you are looking at deploying on Ethereum's mainnet, it is likely that with gas so high and the network so utilized that miners are incentivized to get a block out as fast as possible, and unless the stakes of your lottery get incredibly high (which is not impossible) that it will not be attacked by miners. It would still not be provably fair, as the thing about miner attacks here is that they are largely unprovable - the miner simply does not reveal that they had other solutions to the block.

When looking at the older material (such as these sources), there weren't necessarily any good solutions. Randomness on the blockchain is hard. As has been mentioned, there are good solutions. The two suggested by Gokul Alex (StarkWare Veedoo and Chainlink VRF) both come highly recommended. With (reasonably) easy solutions available, question whether you want to rely on randomness with a known attack vector.

5
  • We are using offchain lottery Mar 23 at 8:09
  • Even if the lottery is offchain, the miners could still attack because they are the ones mining the blocks, and can see what the hashes would be before submitting them to the network.
    – Linum Labs
    Mar 23 at 10:00
  • Yes they could see the hashes before submitting them to the network, but could they change hashes to their will? Mar 23 at 10:35
  • To some degree - that's the theme of the answer. Once that block comes up, they can choose to try to only submit a block that would be beneficial to them.
    – Linum Labs
    Mar 23 at 12:09
  • Aaaa, now I see your point thx, but they only can choose from the some pool of blocks, so they can't choose arbitrary hash, so we need to calculate probabilities for such scenarios, gotcha. Mar 23 at 14:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.