3 ms·

> I can see at least one trivial attack against RANDAO, as is often the case with many-party interactive RNG: you just have to be willing to lose your pledge.

> I can see at least one trivial attack against RANDAO, as is often the case with many-party interactive RNG: you just have to be willing to lose your pledge. What is the trivial attack, and why does it involve losing your pledge? To the best of my knowledge none of Ethereum's slashing conditions involve the RANDAO, so you've piqued my interest. Unless by "losing pledge", you mean extra-protocol slashing by social consensus? You would be doing me a big favor by explaining the vulnerability in this system that I generally consider to be secure.

wyager 4y ago
Let's say you're gambling 10k ETH on the last bit of RANDAO output being 1. You pay 5k to enter, and get either 0 or 10k back. Become a contributor to RANDAO. Put up your pledge (say 1k ETH). Set up the bet. Wait to be the last person to submit their pre-image to RANDAO. Calculate what the post-image will be. If it has a 1 at the end (and you would win 10k), continue as normal. If it would have a 0 (and you would win nothing), refuse to disclose your pre-image and lose your pledge. Now it's 50/50 you win. 50% win and keep pledge. 25% win and lose pledge. 25% lose and lose pledge. EV (0.510k + 0.259k + 0.25*-1k)-5k = 2k. You can submit more than 1 pledge to get your odds arbitrarily close to 100%.
- everfree 4y ago
  > Let's say you're gambling 10k ETH on the last bit of RANDAO output being 1. You pay 5k to enter, and get either 0 or 10k back. Ethereum does not let you make a gamble like that on the protocol level, so it sounds like your proposed attack is against a theoretical gambling platform that naively relies on RANDAO as its sole source of randomness for resolving bets, and that naively allows a user to resolve their bet based on a user-selected RANDAO round, correct? From your previous comment, I somehow got the idea that you were going to describe an attack against Ethereum's Proof of Stake. This section of this article does a good mathematical analysis of RANDAO biasability in the context of leader selection in Ethereum's beacon chain, in my opinion: https://eth2book.info/altair/part2/building_blocks/randomness/#biasability-analyses https://eth2book.info/altair/part2/building_blocks/randomnes... The takeaway from the math is that while it's true the RANDAO is biasable in one-off circumstances through the last-actor pre-image withholding attack you describe, trying to use such an attack to influence network consensus is a no-go. The majority of honest actors ensure that any attempt to bias the RANDAO is ephemeral, where it's only useful for doing a bit flip attack at an unpredictable block height against improperly implemented casino software. I have to say I am a bit disappointed. I thought you were going to describe an attack against PoS.

wyager 4y ago

Let's say you're gambling 10k ETH on the last bit of RANDAO output being 1. You pay 5k to enter, and get either 0 or 10k back. Become a contributor to RANDAO. Put up your pledge (say 1k ETH). Set up the bet. Wait to be the last person to submit their pre-image to RANDAO. Calculate what the post-image will be. If it has a 1 at the end (and you would win 10k), continue as normal. If it would have a 0 (and you would win nothing), refuse to disclose your pre-image and lose your pledge. Now it's 50/50 you win. 50% win and keep pledge. 25% win and lose pledge. 25% lose and lose pledge. EV (0.510k + 0.259k + 0.25*-1k)-5k = 2k. You can submit more than 1 pledge to get your odds arbitrarily close to 100%.

everfree 4y ago
> Let's say you're gambling 10k ETH on the last bit of RANDAO output being 1. You pay 5k to enter, and get either 0 or 10k back. Ethereum does not let you make a gamble like that on the protocol level, so it sounds like your proposed attack is against a theoretical gambling platform that naively relies on RANDAO as its sole source of randomness for resolving bets, and that naively allows a user to resolve their bet based on a user-selected RANDAO round, correct? From your previous comment, I somehow got the idea that you were going to describe an attack against Ethereum's Proof of Stake. This section of this article does a good mathematical analysis of RANDAO biasability in the context of leader selection in Ethereum's beacon chain, in my opinion: https://eth2book.info/altair/part2/building_blocks/randomness/#biasability-analyses https://eth2book.info/altair/part2/building_blocks/randomnes... The takeaway from the math is that while it's true the RANDAO is biasable in one-off circumstances through the last-actor pre-image withholding attack you describe, trying to use such an attack to influence network consensus is a no-go. The majority of honest actors ensure that any attempt to bias the RANDAO is ephemeral, where it's only useful for doing a bit flip attack at an unpredictable block height against improperly implemented casino software. I have to say I am a bit disappointed. I thought you were going to describe an attack against PoS.