Background
Asphodel’s Prologue is an onchain game on Ethereum. One with state logic actually processed end-to-end onchain. It demands randomness sourcing throughout its core flows, as most modern game flows centered around PvP mechanics do. These systems also require a turnaround time of 1-2 blocks rather than whole epochs for the sake of UX, so the question of economic security is one that’s reasoned about on a Pareto front.
I won’t go too deep into the game itself to keep the psychological banner-ads more consensual. But I’ve preserved some educational sections from the original article here, for the benefit of those less familiar with the primitives.
Overview
Prologue operates around two types of player endpoints that handle randomness:
-
Player-Operated Systems – Mints and Trainings are supported through direct contract calls. To source entropy, they’re seeded with the randao value of a future block, accessed through the RLP Header passed in with each reveal and verified using a blockhash with an onchain read window of 8191 blocks (~27h). They rely solely on block rewards to disincentivize potential withholding bias.
-
Keryx-Operated Systems – Duels and Festivals are supported through endpoints currently gated to our matchmaking service Keryx. These are multi-party adversarial engagements that also rely on the same mixhash scheme described above. However they are co-seeded signidice style with an additional secret that’s hashed and submitted onchain during commit, then passed in raw to verify the commitment during its reveal step.
Prevrandao in Production
For those less familiar with making prevrandao usable in production.
We settled on randao over blockhash as our Ethereum-native source of entropy. Most obviously because we can rely on randao to protect a modest sum on its own, unlike blockhash.
Both are only available for a given block after the block has been created, meaning they require the same minimum latency of +1 block prior to being read. But another key difference in the practical application of opcodes BLOCKHASH (0x40) and PREVRANDAO (0x44) are in their retention windows. The former is available for 255 blocks (3h). And the latter for just 1 block.
Normally, this would make BLOCKHASH unwieldy for an idle-esque autobattler like Prologue. And it would outright disqualify PREVRANDAO from production systems, as pinning the reveal to a single block would mean the resolution transaction has to land within that exact block. Unreliable and at the mercy of dynamic network conditions in practice. Our community server would be flooded with requests from players to force-reveal their Taruchi mints.
Thankfully, we don’t have to hold ourselves to such unforgiving standards. In practice, we can extend the slack to 8191 blocks (27h) for both values thanks to a neat trick introduced by EIP-2935, which serves historical blockhashes from the state layer through a dedicated contract.
For blockhashes this is just a direct read from the EIP-2935 contract. For randao values, it involves passing the raw RLP Header of the target block as a parameter of execution. Because the blockhash is computed as keccak256(header) and effectively unique, the contents of the header we pass in can be verified against it. Once confirmed, we can read the mixHash from the header as our seed. In total, this costs the caller an overhead of just ~15k gas between the extra calldata and additional operations.
The Cost of Bias
For those less familiar with randao and its direct economic properties.
The cost to bias a result is defined by the total reward value R of a block. But surrendering that value doesn’t give the proposer full control over the result. Instead, they know what the result will be if they were to contribute, and they have the option to skip their turn if it happens to inconvenience them. This is the withholding bias. It just costs them R of landing that block in turn, to instead let the next proposer roll the dice instead.
In today’s market (July 2026), the median value of R is ~0.056Ξ. And this value is comprised of a few inputs, namely that obtained from the Consensus Layer (staking reward) and the Execution Layer (tips + MEV). The EL fluctuates wildly with market activity, but thankfully, CL is fairly predictable. It’s representative of a soft floor of sorts, and for the sake of some napkin math, we can assume the value of R reliably above 0.05Ξ for the upcoming cycle.
But this isn’t exactly a hard ceiling on the economic value an entropy source can be trusted with. This is the cost to reroll the resulting value once. By refusing to submit one’s known value, the next proposer’s BLS signature determines the resulting mixhash for the block. So for any schemes that rely strictly on a RANDAO hash as its sole source of entropy, we need to ask ourselves: What is the expected value gained from discarding an undesirable result for a new one?
The goalpost has shifted. However, we shouldn’t let the seemingly generous terms lull us into a false sense of security. The threat model expands rapidly across multiple slots, doubling in its granularity of control with each consecutive slot a colluding party owns.
With 1 slot, the party gets to choose between 1 of 2 values. With 3 slots in a row, that party now chooses between 1 of 8 (2^3). And with a large enough proposer set, one could precisely steer the result to target lottery odds. Assuming a party controls all 32/32 proposer slots for an epoch, they could steer the results to precisely target 1 in ~4.3B odds (0.0000000233%). And on average it would cost them about half those slots in block rewards.
16 blocks to rig a lottery, or 0.8Ξ in sacrificed rewards. That’s good ROI.
The Cost of Compromise
The original proposal to replace the DIFFICULTY opcode with PREVRANDAO (EIP-4399) recommends a look ahead of at least 4-epochs for applications with large sums at stake. This is to prevent the proposer set from being known or predictable at the time a caller commits a future reveal-block.
Sounds reasonable in theory. But in practice this translates to ~25min between commit and reveal. Entirely quixotic for most use cases in the realm of consumer entertainment.
Thankfully for our users, we’re application engineers. We’re willing to stop-drill some cracks in the wings to get an airplane off the ground. This often involves some dirty math that the theoreticians or even infra devs of our industry rarely have to grapple with. But in pursuit of the sky, we at the application layer are much more willing to make do.
We break the guidelines of EIP-4399 in exactly two places with Prologue today:
-
the reveal system for Taruchi mint / reroll
-
the resolution system for Taruchi stat training
We do this to preserve their properties of trustlessness, as self contained systems relying strictly on Ethereum for their availability.
Clearly we need to exercise some caution when leaning on randao as their sole source of entropy. But we can’t do this by having our users wait 30min at each step. That wouldn’t be very fun. Instead, we must consider the cost of bias and determine what limits our systems can be pushed to. Because trustlessness doesn’t guarantee their economic sensibilities.
For that, we have to price them.
Pricing a Reroll
The TaruchiRevealSystem determines the traits of the Taruchi a player mints or rerolls. The randao value is their singular source of entropy. And during either commitment step, we target an N+1 future block to source this value. (Gasp)
There are a number of potential approaches to pricing the value of steering randomness in this system, but any top-down EV analysis is a bit unwieldy and relies on several assumptions about the state of opponents in the arena.
The more sensible approach is to directly measure the cost. Rerolls are already priced, explicitly through the game. So players can pay for the same style of trait rolling that’s available to proposers through withholding bias. If the cost of enumerating the equivalent numbers of rolls through withholding bias is higher than that of the standard path, we can assume proposers will not pay more money for what’s already possible at a lower price point.
So we don’t need to price a Taruchi. We can price the direct substitute to the bias itself.
Starting with the cost of a single reroll, which we can assume to be 3 ONYX for the sake of calculation. Conveniently, ONYX is both backed by and denominated in ETH, so the translation is easy. At a market price of 1.23mETH (milliETH) today, the converted values are 3.69mETH . That’s significantly lower than our 1-bit cost of bias, which we evaluated to be ~50mETH.
But our analysis demands a bit more rigor than that. The ‘gotcha’ that most familiar with the topic are acutely aware of is that the cost of bias scales linearly with slots while the potential value it unlocks compounds 2x with each bit under the proposer’s control.
The red line represents the expected cost of steering the bits. It’s scaled against 25mETH rather than 50mETH as, on average, only half the slots will have to be withheld when steering the hash in one’s favor. The blue line represents the value of the rerolls a proposer effectively acquires through their control of these consecutive slots.
Acquiring Slots
So if a singular (or colluding) party can be assigned over 7 consecutive proposer slots, they can gain enough control over the mixhash to target a rarity of Taruchi that exceeds the cost of just paying for the rerolls through the game in ONYX.
| Tail run (k) | Candidate mixes (2^k) | p = 5% | p = 10% | p = 25% |
|---|---|---|---|---|
| 2 | 4 | ~43h | ~11h | ~1.7h |
| 3 | 8 | ~36d | ~4d | ~7h |
| 4 | 16 | ~2y | ~44d | ~27h |
| 5 | 32 | ~39y | ~15mo | ~5d |
| 6 | 64 | ~780y | ~12y | ~18d |
| 7 | 128 | ~15,600y | ~122y | ~73d |
p is the percentage of ownership of all the Ethereum validators in operation. And the value in those columns is how long we could expect a validator set of that concentration to land k slots in a row. According to Data Wallet’s staking report p=25% is like if all of LIDO’s 36 operators colluded together to mint the rarest Taruchi. As alarming as the 73 day projection may appear, we don’t believe it’s a very realistic scenario.
A slightly saner hypothetical might be if one of those operators or a large institutional staker set their sights on Prologue. Most notably these are Binance at ~9.3%, Coinbase at ~7.3% and Figment_io at ~4.1% based on staked balances. For them, it would take a few years. Somewhere in the range of 200 to 75,000. And even this is a fairly far reaching scenario.
But if this were to happen, we could detect it by the concentrated gaps in block production where a rare Tauruchi is revealed off the mixhash generated at the end of that degraded service period. We would be flattered. It would mean our institutional stakers care enough about minting a rare Taruchi they would be willing to sacrifice some 9s in the network’s block throughput.
Summary
There are a couple of caveats, including the input prices used to benchmark the tipping point as well as tail-end slot control schemes that could be leveraged to land more consecutive slots. In the original post, we left this as an exercise for the reader to consider. But some recent reading I’ve done here leaves me with a bit of pause.
In particular, it’s these topics from the Consensus category:
The prior analysis assumes that a large staking party actually finds it worth their efforts to steer the mint results of a single Taruchi, so I assume we’re a ways off from needing to scramble. But I would like to get a better sense for what the actual value is if someone more informed would be willing to chime in. The slots sacrificed to steer the proposer set would eat into the budget, so I can’t imagine the tipping point receding too harshly.
I’m planning to spend a bit more time here as we to continue through our topic list, as this seems like the sort of place that would want to hear how we’re approaching engineering efforts on the dApp layer in 2026. Hoping to nerdsnipe some thinkers back into sovereign world building. But gaming on the L1 is itself a bit of a contentious topic, so I won’t argue the philosophical motivations. Let’s just say we’re doing a cool hard thing and want to share it with everyone here.