I've been watching Substrate_ tutorials for a while now, with the goal of learning a little more about their technology.

My question is:

Would random number generation using Randomness be feasible in a production system?

Specifically using the BABE palette.

Let's take for example the case of a Lottery (a lottery where a lot of money would be at stake) and where we would use this random library for the generation of the winning numbers.

Thank you very much

2 Answers 2


On-chain randomness on any public, decentralized, and deterministic system like a blockchain is difficult.

BABE pallet does provide a source of on-chain randomness, but it has its own limits for security, especially when it comes to being used to win money on chain.

Here is the security note included in the BABE pallet about it's randomness:

    /// # Security
    /// This MUST NOT be used for gambling, as it can be influenced by a
    /// malicious validator in the short term. It MAY be used in many
    /// cryptographic protocols, however, so long as one remembers that this
    /// (like everything else on-chain) it is public. For example, it can be
    /// used where a number is needed that cannot have been chosen by an
    /// adversary, for purposes such as public-coin zero-knowledge proofs.

The way BABE randomness works is that each block producer includes some additional randomness which they can verifiably generate which modifies the current randomness.


This means, to fully control the random value generated, you would need the collusion of all block producers before you, which is extremely unlikely.

However, for the purposes of lottery systems, you don't necessarily need to have every block producer collude to gain an advantage. If the value earned by the lottery is worth more than the value earned by building a block, then you can imagine it would be in the interest of a block producer participating in the lottery to not produce a block where they are not the winner.

And this is where ultimately the security of this randomness value breaks down, and where you need to make your own analysis of attack scenarios to using this randomness.

What we have in Polkadot is good enough for things like candle auctions for choosing parachains, but probably not good enough for the mega-millions lottery system. There is no hard science on exactly where things break down since it is all game-theoretical, but understanding how randomness is generated and can be influenced should give you an impression on where it can and cannot be used.

  • 1
    Thank you very much for your answer. That was my guess. In the case of creating your own custom private network with substrate where all nodes are trusted would not be enough either, am I right? And well, I'm not sure if you could get that trust on all nodes talking about a lot of money. Thanks for your answers again.
    – Alberto
    Feb 10, 2022 at 13:15
  • If all nodes are trusted, then yeah, your randomness should be trusted too since they can only be manipulated by the block producers. But at that point, you can also inject "trusted" randomness into the chain too via a trusted oracle.
    – Shawn Tabrizi
    Feb 10, 2022 at 17:43

Not a full answer but some context that might help:

Babe pallet provides 3 implementation of randomness:

In the documentation you can see the constraints and adversaries for each implementation.

Would random number generation using Randomness be feasible in a production system?

AFAIK it is already used to determine parachain auctions ending times in Kusama.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.