5 ms·
I took a glance at the lottery example [1] and I wonder: isn't the owner of the lottery able to change the outcome so the winningNumber is always in his favor?
by rmetzler 9y ago
I took a glance at the lottery example [1] and I wonder: isn't the owner of the lottery able to change the outcome so the winningNumber is always in his favor?
[1]: https://ethereumdev.io/managing-multiple-users-a-simple-lottery/ https://ethereumdev.io/managing-multiple-users-a-simple-lott...
- ym705 9y agoCould you explain more how would it be possible?
- jsnathan 9y agoIn the example code used, the random number which determines the winner is derived from the previous block hash. Since the lottery-owner determines when the function is run, they could call the function when the previous block hash favors their own bet, or else modify their bet before calling the function.
- ym705 9y agoYep that is why there is a notice and link about random number generation in the tutorial.
- renas 9y agotry this lottery code instead https://github.com/renasboy/ETHLottery https://github.com/renasboy/ETHLottery
- rmetzler 9y agoIs it correct that the betted value doesn't influence any winning chances? Also, is the last byte of the blockhash function return value guaranteed to be equidistributed?
- jsnathan 9y agoYes, but the author does point to [1] for a better way of generating randomness for such a contract using commitments. [1]: https://ethereum.stackexchange.com/questions/191/how-can-i-securely-generate-a-random-number-in-my-smart-contract https://ethereum.stackexchange.com/questions/191/how-can-i-s...
- justinfrankel 9y agothe lottery code is so broken it isn't even funny. actually it is hilarious! the first bet will almost always win, especially if it's a very small bet!