Yashotantra Academy logo
← Vyper theorytheory 0/50 · 0%
level 1
Curious · 0 XP
streak
0d
perfect
0
badges
0

100 XP to Apprentice

Security patterns · medium

34. Randomness pitfalls on chain

Why blockhash/timestamp are not safe randomness sources.

1 min read3 questionsup to 50 XPtopic 34/50

Read in another language

AI translates the explanation and quiz text while preserving code and answer scoring.

Nothing computed purely from on-chain data (`block.timestamp`, `block.number`, `blockhash`, `block.prevrandao`) is safe as the sole source of randomness for anything valuable, because a miner/validator or a contract calling in the same block can see or influence those values before your logic finalizes.

# NOT secure randomness — for illustration only
@internal
@view
def _weak_random() -> uint256:
    return convert(keccak256(concat(convert(block.timestamp, bytes32), convert(block.number, bytes32))), uint256)

For anything valuable (lotteries, loot drops), use a verifiable randomness oracle (e.g. Chainlink VRF) that supplies randomness off chain with a cryptographic proof, rather than deriving it from block data.

How to study this topic

  1. 1. Read the explanation once end to end, skipping the code.
  2. 2. Re-read the code snippets and say out loud what each line does.
  3. 3. Answer the quiz without scrolling back — that is the real check.
  4. 4. Read every explanation, even for the answers you got right.

Scoring

  • · Up to 30 XP from quiz accuracy.
  • · +15 XP for a perfect first attempt.
  • · +5 XP while a 3-day streak is running.
  • · 75% or higher marks the topic complete.

Check your understanding

  1. 1. Why is block.timestamp-derived randomness unsafe?

  2. 2. What's a safer alternative for valuable randomness?

  3. 3. Who can potentially exploit weak on-chain randomness?

Badges

First light
Pass your first topic
Sharp shooter
3 perfect first-try quizzes
On a roll
Study 3 days in a row
Week warrior
Study 7 days in a row
Grinder
Earn 500 XP
Deep diver
Earn 1500 XP