What is entropy illusion vulnerability?
Blockchain systems offer great opportunities for projects and devs, but like any other system, they have a number of certain limitations. One such limitation is determinism - the property of a system or process that its outcome is unambiguously predetermined by initial conditions, input data and rules (algorithm). Determinism is a necessity to maintain decentralized operation of the blockchain system: each node must produce the same result given the same input data.
One vulnerability that can be found during the smart contract audit process is directly related to the determinism of blockchain systems. The issue is called entropy illusion - a vulnerability that occurs when developers use such methods and values in their smart contracts to generate randomness that allow an attacker to calculate the ‘random’ value or manipulate data sources.
Entropy represents the measure of uncertainty, disorder, or chaos in a system. The entropy illusion is pseudo-uncertainty, where randomness is computable or manipulatable.
Why do crypto projects need randomness?
This question is rather rhetorical: without randomness, many successful crypto projects would appear boring and of no interest to anyone. Randomness allows equality of participants, fueling the community's interest in participating in the blockchain project.
- Games
- Lottery
- NFT mining
- all of these concepts presuppose a fair and equal distribution of opportunities among participants.
Another important use of randomness is related to cryptographic security.
Therefore, the entropy illusion vulnerability in crypto projects can lead to serious consequences like unfair lotteries and minting, hacks, loss of trust and interest of the audience.
How entropy illusion issue occurs
Entropy illusion occurs when, during the development of a blockchain project, devs use data sources to generate randomness that can be calculated, controlled, or manipulated by users or miners.
For example:
- Block timestamps
- Block hashes
- Block difficulty or gas limit
- Transaction data
Thus, the data, although diverse, will be only illusory random and the crypto project will be vulnerable to attacks.
How to provide randomness for a cryptoproject?
There are several ways to provide truly random values in a cryptoproject. For example:
- Use trusted solutions for random data generation, for example Chainlink VRF (Verifiable Random Function).
- Use commit-reveal schemes - a type of commitment scheme that can be used for onchain value storing and keeping values secret until explicit disclosure.
- Use external independent oracles.
Conclusion
Entropy illusion is a vulnerability that can cost a crypto project loss of funds, assets and reputation. Therefore, when developing a smart contract that incorporates randomness, it is important to carefully select the method and random data provider for the project, and to verify and audit the randomness logic implementation in the developed smart contracts.
Disclaimer:
Always DYOR. This article is for informational purposes only, does not constitute legal, financial, investment advice and / or professional advice, and we are not responsible for any decisions based on our analysis or recommendations.
