Randomness

Beacon parameters#

The coordinator embeds a specific BN254 drand public key, domain-separation string, genesis time, and three-second period. It does not accept an operator-selected key or arbitrary random value.

Round selection#

roundScheduledAt rejects round zero. roundAtOrAfter chooses the first round whose scheduled timestamp is at least the requested cutoff. Game contracts fix their cutoffs before the relevant random result becomes usable.

scheduledAt(round) = genesis + (round − 1) × 3
roundAtOrAfter(cutoff) = 1 + ceil((cutoff − genesis) / 3)
// cutoff at or before genesis returns round 1

Authentication#

Anyone can relay a signature after its round’s scheduled time. The coordinator parses the G1 point, checks validity, verifies BLS pairing against its embedded public key, and hashes the canonical signature encoding with SHA-256. It stores both roundRandomness and the first successful roundAuthenticatedAt timestamp.

A later relay cannot replace an existing result or reset its first authentication time. A signature is public proof, not a secret supplied by the person settling the game.

Derived outcomes#

derive hashes the domain, chain ID, calling game contract, request ID, state commitment, round, and authenticated randomness. This separates Coinflip, lottery, and turn-game uses even when they share one authenticated round.

The contract depends on the beacon’s cryptographic assumptions, the target chain’s precompiles, timely public data availability, and someone submitting transactions. Domain separation does not eliminate those dependencies.

Recovery differs by game#

Coinflip and lottery use a five-minute authentication cutoff measured from the scheduled round; timely authentication can support later settlement. Tic-Tac-Toe requires a participant to start the game before its start deadline even if the beacon is already authenticated. Read each game’s recovery path rather than applying one timeout rule everywhere.