On-chain Randomness · on KUB
Provably-fair randomness as a service for onchain games and finance on KUB. Your users sign once, a keeper settles in seconds, and your contract gets a callback. Every result is recomputable from public chain data. No oracle, no VRF service.
Your user signs once to commit. A later block's hash, unknowable at that moment, becomes the seed. Then a keeper settles it for free, and the number is just one keccak256 hash anyone can recompute.
keccak256( blockhash · id · requester · seed )
→
0x9f3ac1…b7e2
→
19 pick(0, 37)
Atomic grinding is impossible. Because reveal reverts until the next block is mined, an attacker cannot compute the result and revert on a loss inside one transaction. The most common on-chain gambling exploit is closed by construction.
A primitive that handles value should never overclaim, so we document exactly what it defends and what it does not. It passes 36/36 tests, internal multi-agent passes, and an external hard audit, with no fund-loss bug in the core.
Inherit EntropyConsumerV21 and implement _onRandomness; the base handles the fee, callback auth, anti-spoof, and a recovery path. Open the full SDK & API reference →
// illustrative sketch — full compilable example at /sdk/examples. inherit the SDK base (DurianEntropyV21, KUB chainId 96) contract GigaKingMint is EntropyConsumerV21 { constructor(address e) EntropyConsumerV21(e) {} // 0xa322…EFdC8 // user signs ONCE: pay the gas-scaled fee, reserve a future-block roll function mint() external payable { require(msg.value >= entropy.fee(CB_GAS)); pending[_roll(seed, CB_GAS)] = msg.sender; } // a keeper reveals; the base calls you back, grind-proof (paid at request) function _onRandomness(uint256 id, uint256 r) internal override { _mint(pending[id], pickTier(r)); } }
uint256 r = entropy.reveal(drawId); uint256 winning = r.digits(6); // 482917
uint256 r = entropy.reveal(spinId); uint8 pocket = uint8(r.pick(0, 37)); // 0 to 36
_roll calls); request(seed) is the free, callback-less pathSDK files: durian-entropy.js · EntropyConsumerV21.sol · IEntropyConsumer.sol · EntropyLib.sol · examples: CoinFlip / NFT / Roulette
Derive as many independent values as you need from a single reveal with the EntropyLib helper. Each demo draw below commits and then waits for a real future block to seal, so it can't be rushed.
Every value is keccak256 of a real, unpredictable KUB block hash, so the output is uniformly distributed and nothing the caller controls can bias it. Pick any game and run it hundreds of times from a single block, then watch the distribution level out. The one caveat is economic, not statistical: a block producer can bias a single block, so cap per-round value.
Connect a wallet and the draw runs the live DurianEntropy V2.1 contract: request() then reveal() (the self-serve path, ~0.003 KUB). In production a keeper sends the second transaction, so your users sign once. No wallet? Run a gasless read-only preview.