Insecure Randomness
The use of blockchain hashes for generating random numbers is often criticized due to the potential for manipulation. This manipulation could come not only from miners but also from sophisticated attackers who could leverage techniques similar to flash loans to avoid paying $FLC redemption fees when the redemption outcome is undesirable. Despite this, we believe the use of block hashes for random number generation in our project is adequate due to the following reasons:
NFT Value near Floor Price: The NFTs stored in the vault are primarily near the floor price of the collection. The variance in the value of redeemable NFTs is relatively small, reducing the incentive for miners and sophisticated attackers to manipulate the outcome.
Gas Fees for Unsuccessful Redemption: Even with flash loan-like tactics, exploiters would still need to pay the gas fees for every unsuccessful redemption attempt. The potential cost in terms of wasted gas fees serves as a deterrent against manipulation.
User Actions to Optimize Redemption: Even without specialized tooling, users are able to repeat the deposit and redemption process in an attempt to secure a desired NFT. A small fee is added to redemption to discourage this behavior, yet it is acceptable within our system as it does limited harm to the overall health of the platform.
Short Window for High-value NFTs: In the rare scenario where a significantly high-value NFT enters the vault, it is likely to be acquired by someone who repeatedly redeems in bulk within a short period. The short time window makes it difficult for both miners and sophisticated attackers to manipulate the outcome effectively.
In conclusion, while the use of block hashes for generating random numbers is not entirely manipulation-proof, the specifics of our platform design and the dynamics of our user behavior make this approach sufficiently secure for our application. We believe that the benefits of simplicity and cost-effectiveness outweigh the potential risks, which are mitigated by the factors mentioned above.
Last updated