Nothing computed purely from on-chain data (`block.timestamp`, `block.number`, `blockhash`, `block.prevrandao`) is safe as the sole source of randomness for anything valuable, because a miner/validator or a contract calling in the same block can see or influence those values before your logic finalizes.
# NOT secure randomness — for illustration only
@internal
@view
def _weak_random() -> uint256:
return convert(keccak256(concat(convert(block.timestamp, bytes32), convert(block.number, bytes32))), uint256)For anything valuable (lotteries, loot drops), use a verifiable randomness oracle (e.g. Chainlink VRF) that supplies randomness off chain with a cryptographic proof, rather than deriving it from block data.