Weak randomness

What it is

block.timestamp, blockhash, block.prevrandao and block.number are all visible to — or influenced by — whoever builds the block. Anything seeded from them is predictable to a determined party, and choosable by a party who builds blocks.

Why it matters

If money depends on the outcome, the outcome is selected rather than drawn. Lotteries pay the wrong winner, NFT reveals let bots mint only the rare traits, and a validator can retry until the result suits them.

The vulnerable pattern

Every input here is known or influenceable at execution time.

uint256 winner = uint256(
    keccak256(abi.encodePacked(block.timestamp, block.prevrandao))
) % players.length;

How to fix it

• Use a verifiable randomness oracle for anything with value attached.
• Or use a commit-reveal scheme where participants commit before the seed is known.
• Never derive randomness from a value that appears in the same transaction that consumes it.

How it is detected

Every audit on EVM Smart Audit checks for SWC-120 and reports it as passed or flagged in the standards coverage grid — so the report tells you it was checked even when nothing was found. See the detector suite for what else runs alongside it, or the full database for the other 21 checks.