In this track: Smart contract security foundations
advanced · 4 MIN READ
Predictable randomness
Public or influenceable inputs do not automatically form a fair draw.
LET’S PICTURE IT
A lottery is not fair if a participant can see or choose the ticket-selection rule’s result in advance.
SEE IT FOR YOURSELF
From exact bytes to a Keccak-256 fingerprintStep 1 / 4
The text hello is a particular sequence of characters. Case or text normalization can change the encoded bytes.
The text hello is a particular sequence of characters. Case or text normalization can change the encoded bytes.UTF-8 hello is the five-byte sequence 68 65 6c 6c 6f. The 0x prefix is display notation.The algorithm maps the input to a fixed thirty-two-byte output. This is a fingerprint operation, not reversible encryption.For hello, the digest begins 1c8aff95 and ends 36deac8. The local hash tool displays the complete result and lets you edit the input.
Animated local teaching model. No wallet, RPC or live blockchain data. Some labels and hashes are abbreviated for readability.
Define the adversary’s choices
Ask who can observe inputs, choose transaction timing or withhold participation. Randomness security depends on those abilities, not just a hash function.
Do not hide known data with hashing
Hashing timestamps, user inputs and other predictable values preserves predictability for someone who knows the same inputs.
Review a complete randomness protocol
Commit-reveal, verifiable randomness and other designs have assumptions about bias, availability and liveness. No mechanism is solved by using a familiar acronym alone.
Test withholding and retries
Consider participants who decline to reveal or try again after seeing an unfavorable outcome. The rules should address those choices explicitly.
Reason about the scenario
public known inputs → public computable digest
Review unpredictability, influence, withholding and retry behavior.
Pseudocode or a simplified scenario for local reasoning. This is not a production contract or a completed security review.
QUICK CHECK · NO PRESSURE
Does hashing only public predictable inputs make them secret?