0

I'm curious if anyone operating a node can inspect the EVM memory or stack as contract code is being executed.

For example, a gambling app contract code "draws" a random card by querying a randomness source for a number in range [1, 52]. It stores the raw value of the card in a variable, does stuff with it, then throws it away. Could anyone be watching the EVM memory or stack and read the raw value stored in the variable while the contract code executes?

ShaharZ
  • 103
  • 1

1 Answers1

1

Yeah, that's exactly how Ethereum works. Anyone can verify what your contract has done, all data is public.

I see 2 options:

  1. Generate random card after all users' actions that depend on it. However, in some cases it also can be exploited. There's no such thing as randomness in blockchain. You use some history data to generate an number - block hash, for example. If you use block hash and history of actions, attacker may calculate all outcomes locally and pass "good one". So, you can only trust actions that happened in previous blocks, since attacker cannot calculate hash of new block to guess your number. Read this question for detailed answer.
  2. Use off-chain randomness. Someone should pass random number to contract. But then your actual users cannot trust that source.
Andrey Putilin
  • 708
  • 3
  • 13