
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
@pythnetwork/entropy-sdk-solidity
Advanced tools
The Pyth Entropy Solidity SDK allows you to generate secure random numbers on the blockchain by interacting with the Pyth Entropy protocol. This SDK can be used for any application that requires random numbers, such as NFT mints, gaming, and more.
WARNING: The Entropy protocol is currently in testnet. It is NOT INTENDED for use in production applications. Use this protocol at your own risk.
npm install @pythnetwork/entropy-sdk-solidity
To use the SDK, you need the address of an Entropy contract on your blockchain and a randomness provider. The following table lists the current deployments of entropy.
| Chain | Entropy Address | Provider |
|-----------------|--------------------------------------------|--------------------------------------------|
| avalanche-fuji | 0xD42c7a708E74AD19401D907a14146F006c851Ee3 | 0x6CC14824Ea2918f5De5C2f75A9Da968ad4BD6344 |
| optimism-goerli | 0x28F16Af4D87523910b843a801454AEde5F9B0459 | 0x6CC14824Ea2918f5De5C2f75A9Da968ad4BD6344 |
| eos-evm-testnet | 0xD42c7a708E74AD19401D907a14146F006c851Ee3 | 0x6CC14824Ea2918f5De5C2f75A9Da968ad4BD6344 |
Choose one of these networks and instantiate an IEntropy
contract in your solidity contract:
IEntropy entropy = IEntropy(<address>);
To generate a random number, follow these steps.
Generate a 32-byte random number on the client side, then hash it with keccak256 to create a commitment. You can do this with typescript and web3.js as follows:
const randomNumber = web3.utils.randomHex(32);
const commitment = web3.utils.keccak256(randomNumber);
Invoke the request
method of the IEntropy
contract:
uint64 sequenceNumber = entropy.request(provider, commitment, true)
This method returns a sequence number. Store this sequence number for use in later steps.
If you are invoking this off-chain, the method also emits a PythRandomEvents.Requested
event that contains the sequence number in it.
Fetch the provider's random number from them.
For the provider 0x6CC14824Ea2918f5De5C2f75A9Da968ad4BD6344
you can query the webservice at https://fortuna-staging.pyth.network :
await axios.get(
`https://fortuna-staging.pyth.network/v1/chains/${chainName}/revelations/${sequenceNumber}`
);
This method returns a JSON object containing the provider's random number.
Invoke the reveal
method on the IEntropy
contract:
bytes32 randomNumber = entropy.reveal(
provider,
sequenceNumber,
randomNumber,
providerRandomNumber
)
This method will combine the user and provider's random numbers, along with the blockhash, to construct the final secure random number.
FAQs
Generate secure random numbers with Pyth Entropy
The npm package @pythnetwork/entropy-sdk-solidity receives a total of 57 weekly downloads. As such, @pythnetwork/entropy-sdk-solidity popularity was classified as not popular.
We found that @pythnetwork/entropy-sdk-solidity demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.