# Block-derived randomness drain

Randomness from blockhash, timestamp, prevrandao or counters that a caller can predict or grind

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2026-03-19. Updated 2026-10-23._

## How it works
A contract needs an unpredictable outcome (a mint bonus, a game result, a raffle winner) but derives it from values the caller can know or influence before committing: `block.timestamp`, `blockhash`, `prevrandao`, `gaslimit`, `coinbase`, `block.number`, or a storage counter. The broken assumption is that these are unknown at decision time. They are not: the caller can compute the outcome off-chain, pick a favorable block, or repeat the call until the condition passes. A related shape is an async oracle whose pending request can be rotated before it resolves, so the caller discards outcomes it dislikes.

## Where it shows up
- Modulo or comparison on block data or a counter in mint, reward, or win logic [E3](https://bugbountylibrary.com/r/dhl%3A20250314-h2o.md)[E4](https://bugbountylibrary.com/r/dhl%3A20240527-redkeyscoin.md)
- A fallback RNG path used when a primary source (e.g. `blockhash`) expires [E2](https://bugbountylibrary.com/r/dhl%3A20260319-atmblindbox.md)
- Async oracle requestId stored in state and swappable by a user-triggerable action before the callback [E1](https://bugbountylibrary.com/r/c4%3A2022-12-forgeries%3AH-02.md)
- Underfunded oracle subscription or long callback latency paired with a short redraw cooldown [E1](https://bugbountylibrary.com/r/c4%3A2022-12-forgeries%3AH-02.md)

## How to review
The invariant: no user action between entropy commitment and entropy consumption may let the user know or change the outcome. Concretely:
- Confirm the random source is unpredictable to the caller at the moment they commit value; block data and counters fail this.
- Check every fallback path, not just the primary RNG; a fallback to `prevrandao`/`timestamp` is equally predictable [E2](https://bugbountylibrary.com/r/dhl%3A20260319-atmblindbox.md).
- For async oracles, confirm the stored requestId is immutable until the callback resolves, and that no redraw/rotate action is reachable while a request is pending [E1](https://bugbountylibrary.com/r/c4%3A2022-12-forgeries%3AH-02.md).
- Compare oracle latency bounds against any cooldown that permits re-requesting [E1](https://bugbountylibrary.com/r/c4%3A2022-12-forgeries%3AH-02.md).

## Variants seen
- Predictable block-data RNG in a mint, ground across blocks and funded by flash loan [E3](https://bugbountylibrary.com/r/dhl%3A20250314-h2o.md)
- Predictable block-data RNG in a game, simulated off-chain before betting [E4](https://bugbountylibrary.com/r/dhl%3A20240527-redkeyscoin.md)
- Fallback RNG after `blockhash` expiry, predictable before submission [E2](https://bugbountylibrary.com/r/dhl%3A20260319-atmblindbox.md)
- RequestId rotation to discard unfavorable VRF output [E1](https://bugbountylibrary.com/r/c4%3A2022-12-forgeries%3AH-02.md)

## Impact and severity
Full drain of contract funds in the mint and game cases [E3](https://bugbountylibrary.com/r/dhl%3A20250314-h2o.md)[E4](https://bugbountylibrary.com/r/dhl%3A20240527-redkeyscoin.md), and a 99K USD drain via the fallback path [E2](https://bugbountylibrary.com/r/dhl%3A20260319-atmblindbox.md); rigged winners and stolen jackpots in the raffle case [E1](https://bugbountylibrary.com/r/c4%3A2022-12-forgeries%3AH-02.md). Severity is high whenever the random value gates a payout or mint. It worsens when flash loans remove the capital barrier to grinding [E3](https://bugbountylibrary.com/r/dhl%3A20250314-h2o.md) and when the attacker can simulate the exact inputs off-chain before committing [E2](https://bugbountylibrary.com/r/dhl%3A20260319-atmblindbox.md)[E4](https://bugbountylibrary.com/r/dhl%3A20240527-redkeyscoin.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2022-12-forgeries%3AH-02.md
- E2: https://bugbountylibrary.com/r/dhl%3A20260319-atmblindbox.md
- E3: https://bugbountylibrary.com/r/dhl%3A20250314-h2o.md
- E4: https://bugbountylibrary.com/r/dhl%3A20240527-redkeyscoin.md