Chainlink VRF explained: how a lottery winner is picked on-chain

Chainlink VRF is the random-number service behind most fair on-chain games, including DecentraLotto. It hands a smart contract a random number together with a cryptographic proof that the number was not tampered with. Here is how it works, in player terms, and why it matters for who wins.

Why a blockchain needs outside randomness

Everything a smart contract does must be reproducible: thousands of computers re-run the same code and must get the same result. That is great for accounting and terrible for dice. A contract has no private source of chance, and the "random-looking" values it can see — block timestamps, block hashes — are known to, and to some degree chosen by, whoever produces the block. A lottery that used them could be gamed by exactly the people with the most power over the chain.

The fix is to bring the randomness in from outside, but in a way the contract can check. That is what a verifiable random function does.

What a VRF is

A VRF is a piece of cryptography with three properties:

• Unpredictable. Without the oracle's secret key, nobody can compute the output for a given input — not players, not the lottery operator.
• Unique. For a given input and key there is exactly one valid output. The oracle cannot shop around for a number it prefers.
• Verifiable. The output comes with a proof that anyone can check against the oracle's public key.

Put together: the oracle can compute the number, but it cannot choose it, and it cannot hide that it cheated if it tried.

What happens in a DecentraLotto draw

1. The round closes. When the time is up, the target is reached or the last seat is taken, the lottery contract stops accepting entries. From this moment the list of tickets is final.
2. The contract requests randomness. It calls the Chainlink VRF coordinator — a contract on Arbitrum — asking for one random number per prize place. The request gets a unique ID, recorded in the DrawRequested event.
3. The oracle answers. After a few blocks, a Chainlink node computes the VRF output for that request with its secret key and sends it, with the proof, to the coordinator.
4. The coordinator checks the proof. Only if the proof is valid does the coordinator pass the random numbers to the lottery contract. The event RandomWordsFulfilled records the seed for everyone to see.
5. The contract picks the winners. It computes the winning ticket(s) from the random numbers, looks up their owners, credits the prizes and immediately opens the next round.

Steps 2 to 5 usually take well under a minute on Arbitrum. The key point is the order: the tickets are fixed before the random number exists, and the random number cannot be changed once it exists.

From random number to winning ticket

The coordinator turns one seed into as many random words as were requested, using a public formula: word[i] = keccak256(abi.encode(seed, i)). The lottery then uses simple modular arithmetic:

• Single winner (Speed Round, Jackpot): winning ticket = word[0] mod tickets sold.
• Several places (Stack): place i takes the ticket at position i + word[i] mod (tickets − i) of a shuffled list, and the drawn ticket is swapped out so it cannot win again. This is a partial Fisher–Yates shuffle, the textbook way to draw without repetition.

Because every input is public, anyone can repeat this math. Our draw checker does it in your browser for any finished round.

What VRF protects against — and what it does not

It protects against the operator choosing the winner, players predicting the outcome, block producers nudging the result, and the oracle substituting a number it likes.

It does not, on its own, protect against an oracle that simply never answers. A node cannot change the number, but it could stay silent. A well-designed lottery plans for that: on DecentraLotto, if the random number has not arrived 24 hours after the request, anyone can cancel the draw and every player takes a full refund. Nobody's money is stuck.

It also does not fix bugs in the lottery contract itself, which is why the contract's source should be public and verified, and ideally audited.

How to check it on a block explorer

1. Open a finished round on DecentraLotto and follow the link to its settlement transaction.
2. In the transaction's logs, find RandomWordsFulfilled from the VRF coordinator: the requestId must match the round's DrawRequested, and outputSeed is the seed.
3. Compute keccak256(abi.encode(seed, 0)) and take it modulo the round's ticket count.
4. Compare with the PrizeAwarded event in the same transaction.

Or let the checker do it. Either way, you are checking the chain, not us. For the bigger picture, read What is a provably fair lottery?