Fabiano Pereira Soriani ~ Everyday I'm Shuffling Cats: Random Number Generation for Ethereum Dapps

[Music] thank you so welcome everyone my name is Fabiana it's my second time here you need ever I'm very excited to present you guys one more lesson from developed crypto kitties I'd say this was one of the biggest challenges we had developing crypto kitties and we hope that you can take away like a technical framework that you can implement random number generation on your games to make it more fun or whatever so yeah so today we're gonna go to this journey we're gonna oh I think I'm missing here oh yeah wait yeah okay thanks so we're gonna go to the journey a little bit we're gonna talk about random and random on a theory or in particular we're going to talk about crypto kiddies the goals we had the constraints we had and eventually how we got it right so there are many ways to get it wrong first of all randomness developers mostly know what randomness is but random is is like the lack of better and predictability on events and individual events random events are unpredictable what does it mean practice for us is that it you know it can mess with expectations and make fun things happen on your dad so back in August we were fooling around with the theory I'm really with the wait we knew we wanted to make a project with kiddies and we knew we wanted to use blockchain because we never use blockchain before so it was our first experience with bok choy and we also knew about crypto punks so crypto Punk's is a really interesting project is one of the first of art on the blockchain they had punks like this fix election of bugs and they had characteristics so like some have a cigar some have like a Mohawks you know blonde hair etc and you can like you cannot make our own Punk but you can buy punks and sell punks so we wanted to do something different we wanted to do some sort of art that it could make our own art and the way to do that we have like Kitty's several layers of things of characteristics on kitties and we wanted to do near infinite combinations but we didn't want the users to just like simply choose we wanted to do something that's more like by a biological feeling to it so we needed a random number generation genetic algorithm for it and that's the sad that's that's how we set that that's what we wanted like as much as like when two people have a baby or animals have a baby you don't know exactly how they're going like but they kind of look like the parents that's what we aim for the problem is that was the biggest problem a theorem has no random function and that makes total sense as any blockchain anyone who computes a block they need to be able to deterministically compute a block so the results must be the same on every sort of contract because of that again there's no random there is nothing like a random on atrium so yeah we needed we needed something like that but first of all motivation like why why does it even matter so why should you care because it's really cool players remember for a long time when the breeding they wanted to do went wrong or went spectacularly right so I asked the community for bad examples and they found a lot of examples but these are the best so this one you have this cat and you have this Dame she got spots you got like this beautiful purple belly and this is red eyes and then you have the father who's like you know refined gentleman stuff and then he got like this white and yellow colors and crazy eyes and then they got the child and the child out of there you got this mustache and that was random those are like he didn't trade so they bubble up in the cat genome but you can see it's still like it still keeps some of the the mother like the belly and the pattern and it keeps the colors of the father but because there is randomness to it it bubble up like crazy this one is kind of like the other end of the spectrum so this guy he had two super cool cats so this one has like unicorn horns like angel wings and the other one is like in the middle of lava and stuff and then the child is like the most average could be so again like hidden trades bubbling up but still you can see the you know the parents they're a little bit a little bit so let's go that's what we aim for and that's why we bothered with all this so for the random number generation we wanted something cheap so anyone could call a multiple time's right now we have over 1.6 million cats on on crypto kitties and it would not be possible if there was not like a lot of if it wasn't cheap enough also it's fair and I'm predictable so no one can predict it because that's random and you need multiple numbers per transaction because we have many genes and it should be tamper proof temper proof breaks down into categories mainly one is user interference the other one is minor interference we wanted to be safe from both but specially users and last one is the centralized so we didn't want to be posted to be necessary that we were involved in the process we want anyone to just use solidity and you know a theory of network and do it so we have to investigate and the first investigation was Oracle's on our Oracle's just like a tldr is that only theorem there is this pattern called Oracle's Oracle's are bridges between outside etherium and inside etherium so Oracle's often they just get information from databases from api's and they put on the ATM network so we thought oh maybe we can get random numbers from from outside and you know like some random API or something so we look into it we look into a solution called oracle eyes and oracle eyes is a centralized service so it had a very lot a lot of things we didn't want one of them is like it's not cheap it's probably fair and unpredictable they probably would not tamper with it but we couldn't you know we couldn't prove it anyway and you cannot get multiple random number generations per transaction because you have to make a call like give me an random number and then wait whenever they are ready to send then they say in a callback and then the number comes in so it's not the centralized it was not what we wanted so we look for next step was we're looking entropy sources on chain and there is own chain you mainly find like the blocks and the messages like transactions so we focus so messages they're completely chosen by the user so we didn't do we didn't actually use messages within the news transactions but we look into the blocks so the blocks are produced by miners as we know this is like the short list of the properties that we saw that could be interesting so I just start from the bottom timestamp so we know blocks are produced about every 15 seconds we thought maybe we can use that sort of variance in the time that block is created to to see the entropy but soon enough we realize that it's 100% controlled by miners so miners have like a huge window they can set times it was interesting to them they could just set the time and we couldn't do anything about it the other one is coinbase coinbase is the address of the miner who mined the block and again it's fully controlled by a miners they can just choose you know they can just set whatever address they want so again it's not really good because it's 100% controlled by miners and the only solution that seems to be really good is block hash so block hash is not tempura Bowl with in proof-of-work the only and it's a huge seed is like 256 black bits which is like a really really big number and that's something you want when you're looking for entropy you want like a really big seed the thing is it's not always available because of own solidity smart contracts you only have the block hash for the last 256 blocks so that's a bit of a problem but you know it's by far the best source of entropy so first attempt this is our contract this is our first attempt contract it's just a you know this is the simplified version but it's a seed so you keep a seed as internal state and every time someone asks for a number you will update the seed by hashing the seed itself with block hash what coinbase we're difficult to you which is another property from the block and yeah that that's all righty but the block hash in this system because we're not committing to a certain block the user could choose to call in the block that's better for them so if you're like an advanced user it can be good for you because you can like just simulate calls until you're happy with the results so this is not good and then the coin based in difficulty miners could manipulate and again like we're less worried about miners but yeah but this one this this method here it privileges powerful users so that's not good the second attempt was actually committing to a block so you can sing the function parameter here we commit to a block so we say at block let's say 1000 you get the seed from that block and let's say if the block is passed then you just get the value 0 so you don't get to choose but this one also had a problem then we realized the seed is the problem so we cannot have a seed because the seed means that the user can call it can call this function or care wait this function to be called until it's convenient for them so the seed is basically keeping state and that allows to reroll so that that allows for user tampering with a random function so keeping state was not good yeah so but the block cash is good because miners cannot manipulate although it can expire so dissolution is cheap it's quite cheap it's fair because well it's kind of fair because users could manipulate the seed but it does give us like many random numbers per transaction so we can have as many as we need and we do need a lot we did get tamper proof no sorry we didn't get temper proof because again we have the seed but it's the centralized it does not require us or Oracle's so that's good but then eventually we got it right so the final the final overall idea is we have a breeder so we have a breeder the user who's using the random who's gonna use who's gonna benefit from the random function puts a bounty on it they put like I don't know like 0 in our case is 0.008 aetherium and nothing happened just like that time pass on because in our case the breeders they breed their cats and then they have to wait until the cats ready give birth so when the cat's ready to give birth anyone on the network and call give birth and get the bounty yeah so that has several benefits including that we get so on the Tyrian you cannot schedule functions to be called if we could schedule functions we would definitely just do a scheduled function but you can't so this has the benefit that users have their cat being birth in a timely manner because someone like right now we have competition like many people many people will call them birthers the birther is like they compete to give birth to the cat and sometimes they win sometimes they don't but they they make money from it and yeah and also like the users benefit from it because they have their cats being born in a timely manner which is what a user wants anyway cool I hope you guys can see it here it's kind of small but this is this is the contract so it's splitting two contracts it could be one but we decided to do two for modularity sake so we have the main crypto kitties and then again this is the third step someone calls give birth we got the matron we check if it's ready on line seven and then we call gin science which makes the jeans so we pass the genes of the the first pair and the second parent and we pass the target block that we're gonna use to get the block hash from so this will never change unless the random is zero so then we do some magic the contract is public by the way now so you can check our contract for the I'll pass the link later but like yeah you can check this is like a simplified version and then to get the actual random number we hash everything including the the block hash we had before with the genes of parent one the genes of parents you and the target block again so yeah it's a it's pretty much like set meaning doesn't matter what block a call it's pretty much the same thing and because we have the economic incentive to call first to give birth we pretty much have the guarantee that the block hash will never expire and then we do stuff so this is like this forstuff here it's interesting that we don't we avoid calling so we could call this CAC 256 again and again again the problem with this one is kind of expensive so what we do instead is like we keep slicing that number that random number we got into smaller chunks to the chunks we need because often we just need like two bits four bits something like that so this is kind of cheap it's not super cheap but it's cheap enough requires a bounty people have to you know when they breed they have to put a bounty on so I think works but it's very unpredictable we can get multiple numbers it is temper proof by just anyone and is decentralized so it does achieve pretty much everything we set over the contracts ours can find on my presentation or in the cryptic it is blog it we also publish there and that's the general idea so I just wanted to give you guys like a second approach which can also work so a second approach is that the user commits to have around them number generation at a certain block and option a is they put a bounty option to is the person who actually going to benefit from the result of the random they have to call within 255 blocks or they will lose the chance but it almost about it because in this alternative there is no bounty they just say use whatever is the hash of the next block or ten blocks from now or thousand blocks from now and they go a thousand blocks from now and they call it again so they could is that and you can keep slicing as I said to save gas so you can keep slicing if you don't need the whole 256 bit number which is really big and no one really needs that so you can just use bits from that the Cavitt is it relies on proof of work so this method is only strong as proof of work is don't use it for any reward that's bigger than three ether like that's the block reward right now because then you kind of give in miners an incentive to drop valid blocks so you're actually competing with the theorem that the protocol itself which is really interesting but if you keep like whatever they can make they can profit from your random number below three either you probably fine because miners wouldn't bother using like custom software to screw you over and the other one the other thing is like once it Tyrion changes to proof of steak then this won't work anymore because this really isn't proof of work on the other hand the Bitcoin chain and this is a bacon chain it's it's like the Bitcoin chain is just like a bunch of random number generator it's just so it's like it's a random number source dude you're not gonna need this technique once we have a bit crunchier credits thanks for Nick Johnson who works on the etherium on the team right now for pointing out this committee review system thanks for our critics Micah's o2 and Razer for pointing out the flaws in the initial techniques and we have a framework description with everything I just said in axioms and / it random and also our contract source code it's on the crypto key this blog so just look for those if you're interested and we have a quick plug so crypto kiddies now the company is called dapper labs but we're hiring so we're hiring for many positions and we have the key diverse program which it's not a bounty exactly but it can give you money and mentorship and api's to build on top of crypto kiddies so that can be interesting I also have a bunch of stickers here so please come if you want stickers I have several types of cryptic it is here