Game outcomes
Reveal deterministic candidates through an authenticated callback, then let the player choose or mint in a separate transaction.
ONCHAIN RANDOMNESS
A block is not a dice roll.
Randomness needs proof.
A smart contract can’t roll dice on its own. Values it can read, like a block hash or block.prevrandao, can be predicted or nudged by whoever produces the block. On some chains, Arc included, PREVRANDAO is simply 0. D20DAO delivers each result with a VRF proof, so anyone can check it from public chain data.
Burst of 200 requests
Up to 16 requests per transaction.
Each has its own proof, fee and callback.
Arc Testnet · · two keepers · not an SLA
| Time | Block | Event | Requests | Opened | Served |
|---|---|---|---|---|---|
| 0 s | 62,741,836 | Request 0xeb150b… | 50 | 50 | 0 |
| 0 s | 62,741,836 | Request 0x9cd434… | 50 | 100 | 0 |
| 1 s | 62,741,837 | Request 0xc9a65b… | 50 | 150 | 0 |
| 1 s | 62,741,837 | Request 0xc2f954… | 50 | 200 | 0 |
| 1 s | 62,741,838 | Epoch 1460 published 0x6ebac8… | — | 200 | 0 |
| 4 s | 62,741,843 | Fulfillment 0x76ff20… | 4 | 200 | 4 |
| 4 s | 62,741,843 | Fulfillment 0xedbf48… | 8 | 200 | 12 |
| 6 s | 62,741,847 | Fulfillment 0xa5de9b… | 8 | 200 | 20 |
| 7 s | 62,741,848 | Fulfillment 0x9871f2… | 8 | 200 | 28 |
| 8 s | 62,741,850 | Fulfillment 0xb68456… | 16 | 200 | 44 |
| 9 s | 62,741,852 | Fulfillment 0xd11145… | 8 | 200 | 52 |
| 9 s | 62,741,852 | Fulfillment 0xa6d7ed… | 16 | 200 | 68 |
| 10 s | 62,741,855 | Fulfillment 0x910b20… | 16 | 200 | 84 |
| 11 s | 62,741,857 | Fulfillment 0x0ad405… | 16 | 200 | 100 |
| 11 s | 62,741,857 | Fulfillment 0xf0c4e2… | 16 | 200 | 116 |
| 12 s | 62,741,859 | Fulfillment 0x42b398… | 16 | 200 | 132 |
| 13 s | 62,741,860 | Fulfillment 0xe10c21… | 16 | 200 | 148 |
| 13 s | 62,741,860 | Fulfillment 0xfe203c… | 16 | 200 | 164 |
| 14 s | 62,741,862 | Fulfillment 0xda16d4… | 8 | 200 | 172 |
| 15 s | 62,741,864 | Fulfillment 0x5a1ff9… | 8 | 200 | 180 |
| 15 s | 62,741,865 | Fulfillment 0x56b7e9… | 16 | 200 | 196 |
| 16 s | 62,741,867 | Fulfillment 0x8123c1… | 4 | 200 | 200 |
TWO NETWORKS
Arc and Robinhood.
One interface.
The same consumer contract on both. Each network binds drand its own way.
Compare the networksLIVE ONFEES IN
- USDC
Arc Mainnet · Epochs plus drand
Each 200-block epoch commits one drand round for paid demand; a VRF proof binds a future block.
- ETH
Robinhood Chain · Round-bound drand
Each request is bound to a future drand round when it is made, so nobody can know or choose the result in advance. The contract verifies the drand signature and the VRF proof on chain, and anyone can replay a result from public data.
01 / THE ENTROPY PATH
External inputs.
Onchain evidence.
On Arc, D20DAO prepares a drand round locally for each 200-block epoch. A paid request triggers publication, then a future block hash binds the fixed input for a verifiable result. On Robinhood Chain, each request binds a future round instead.
- 01
Prepare the epoch
The keeper prepares the drand round current at the epoch’s start. Idle epochs stay local.
- 02
Publish for demand
A paid request escrows its fee. The keeper publishes the round for live demand and the registry verifies its signature.
- 03
Prove and deliver
A block strictly after publication supplies the target hash. The fixed-key proof is verified and the result delivered.
01drand
Signed round
02D20DAO
Request-bound VRF
03Onchain
Proof and result
02 / THE SOURCE
One public beacon.
Checked onchain.
Every result rests on drand, a public randomness beacon run by the League of Entropy. On Arc each epoch commits one round; on Robinhood Chain each request binds one. Its signature is verified onchain.
Source data. Your application.
The source supplies an input; your application decides how to use the verified result. Build game outcomes, community selections or automated decisions from the same random word.
AN EPOCH COMMITSONCHAIN
- Round and signature
Randomness beacon
drand evmnet
- Number, in decimal
Round
one every 3 seconds
- Timestamp
Scheduled time
genesis + (round − 1) × 3 s
- Verified onchain
Signature
64 bytes, BLS on BN254
- Enforced by the registry
Freshness
at most 240 seconds at publication
03 / INSIDE THE KEEPER
One request.
Every step in view.
From local preparation to on-demand publication and a future-block proof. Explore an illustrative request trace.
Read the keeper architecture KEEPER LABINTERACTIVE PREVIEW
Example block settings
Request #1 / epoch 1 / on-demand publication / 60s deadline
CHANGE A BLOCK. FOLLOW THE DATA.
Ready to trace
Illustrative data and output; no drand signature or VRF proof is generated.
04 / INDEPENDENT VERIFICATION
Replay the path.
Byte for byte.
Follow a result back to its drand round and onchain proof. Public evidence lets your application and its users check how the outcome was produced.
Verify the drand signature, replay the randomness proof and reproduce the final selection using public chain records.
Explore the evidence formatSeparate by design
Keeper Prepares epochs and submits request proofs.
Coordinator Verifies evidence and settles requests.
Public replay Reconstructs results from chain evidence.
EVIDENCE EXPLORERDRAND ROUND
- Round
21115909- Scheduled
- 2026-10-01 15:33:19 UTC
- Committed in
- Arc Mainnet, epoch 12448
Ready to verify
Open epoch 12448 in the explorer05 / BUILD ON THE SAME WORD
Applications. Communities.
Autonomous apps.
Turn a verified word into a selection, sequence or number. Public mappings make each outcome reproducible across applications.
For AI agents
Buy verifiable randomness over HTTP with x402. 0.05 USDC per call, no contract.
Community selections
Select entries from a list fixed before the request. Public mappings reproduce the selected indices and their order.
Agent-driven decisions
Bring verifiable selections into agent workflows. Each decision carries a result and the evidence behind it.
FOR DEVELOPERS / SOLIDITY
Integrate in
26 lines.
Request a word. Receive an authenticated callback. Build your application around a result you can verify.
- 01
Connect the coordinator
Use the consumer base to authenticate every callback.
- 02
Pay the quoted fee
Pay quoteFee in the same transaction and pin the refund address.
- 03
Store the result
Keep delivery small. Apply your application rules separately.
RandomApp.solSolidity / 26 lines
// SPDX-License-Identifier: MITpragma solidity 0.8.28;import {D20VRFConsumer} from "./protocol/D20VRFConsumer.sol";import {ID20VRF} from "./protocol/interfaces/ID20VRF.sol";contract RandomApp is D20VRFConsumer { ID20VRF public immutable rng; mapping(uint256 => bytes32) public results; mapping(uint256 => bool) private requested; constructor(address coordinator) D20VRFConsumer(coordinator) { rng = ID20VRF(coordinator); } function request(bytes32 input) external payable returns (uint256 id) { require(msg.value >= rng.quoteFee(100_000), "Fee below quote"); id = rng.requestRandomness{value: msg.value}(input, 100_000, msg.sender); requested[id] = true; } function _fulfillRandomness(uint256 id, bytes32 word) internal override { require(requested[id], "Unknown request"); delete requested[id]; results[id] = word; }}06 / SPEED + PROOF
A few blocks.
A verifiable result.
From request to a result your application can use. Follow the proof, then build on the outcome.
≈4
BLOCKSMeasured median for an isolated request on Arc Testnet. Robinhood Chain: 5–8 s typical. Benchmarks
Result delivered
The application receives the authenticated result and its evidence remains available for replay.
Ready for your application
Map the verified word into a range, selection or shuffle with repeatable built-in functions.
Inspect every result
Follow the request and proof in the Explorer. Replay the evidence and check the outcome independently.
FROM THE BLOG
Latest guides.
Project updates.
Integration guides and project news for developers building on Arc and Robinhood Chain.
All guides and updatesVerifiable Loot Drops on Arc and Robinhood Chain
Build loot rolls players can check: fix the drop table, map a D20DAO VRF result to weighted items, and recover delivery without rerolling the reward.
D20DAO Wins an Arc Microgrant
D20DAO is one of 20 Arc Microgrant winners selected from 797 submissions, building verifiable randomness for onchain apps and AI agents.
Verifiable Randomness for AI Agents on Arc: An x402 Workflow
Give an agent a fixed list, a spending limit and a verifiable draw. Use D20DAO's MCP tools and x402 API on Arc, then check the result independently.
07 / YOUR QUESTIONS
Ready to
build?
How to integrate, verify results and handle delivery.
Start BuildingExtend D20VRFConsumer, pay the coordinator’s quoted fee and submit a randomness request with a fixed refund address. Receive the result in an authenticated callback, then use it in your application. See the integration guide for an example consumer. Agents and services without a contract can call the HTTP API over x402 instead.
Arc and Robinhood Chain, each with a mainnet and a testnet. The consumer interface is the same; fees are paid in USDC on Arc and in ETH on Robinhood Chain. The x402 agent API runs on Arc.
A public randomness beacon run by the League of Entropy. On Arc, each 200-block epoch commits one drand round, published only for a live paid request and verified onchain. On Robinhood Chain, each request is bound to a future round.
Each request is bound to a future drand round when it is made, so nobody can know or choose the result in advance. The contract verifies the drand signature and the VRF proof on chain, and anyone can replay a result from public data. A typical delivery takes 5–8 seconds.
On Arc no epoch is published, because there is no fallback source. Affected requests expire and their escrowed fee is refundable to the fixed refund address.
It shows what the beacon’s key signed for that round, not that the beacon is unbiased or independent of its operators. An epoch can commit any round scheduled in the last 240 seconds, and the committer chooses which. The VRF proof and chain evidence are verified separately.
Yes. The MCP server @d20dao/mcp gives Claude, Cursor, VS Code and other MCP clients the same draws as tools. It holds no keys: it pays through the Circle CLI from the user's own Circle Agent Wallet, within a daily limit the user sets. See For agents.
Yes. Map a verified random word to a number, a selection or a shuffled sequence. Public mapping functions let your application and its users reproduce the same outcome from the same word.
In the Arc Testnet load test on 2026-09-18, isolated requests completed in a median of 2 seconds (4 blocks), at most 14 seconds; a burst of 200 requests was fully served within the 60-second deadline. These are measurements, not guarantees: epoch readiness, load and network conditions affect timing. See Benchmarks, and inspect request and fulfillment blocks in the Explorer.
On Arc Mainnet the fee is max(0.02 USDC, 3 × base fee × (300,000 + callback gas)), paid in native USDC by the requesting transaction. At Arc's usual 20 gwei base fee a 100,000-gas callback pays 0.024 USDC. The owner sets pricing for future requests; the Explorer shows the live quote. On Robinhood Chain the fee is max(0.000025 ETH, 2 × base fee × (405,000 + callback gas)), paid in ETH. The agent API charges a flat 0.05 USDC per call over x402.
A valid proof must be accepted onchain at or before the 60-second deadline. After expiry, an unfulfilled request’s escrowed fee is claimable by transaction for its fixed refund address, at the refund ratio fixed when it was requested. Gas and application fees are outside the refund.
Accepted proof earns the configured keeper and treasury shares. If the callback fails, delivery can be retried with the same stored word and no second service fee.
On Arc, EpochCommitted logs contain the epoch’s drand round and signature once per epoch; accepted request logs contain the VRF proof. The public replay library (SDK 0.6.2 or newer) recomputes epoch selection, the drand signature, the output, mapping and transcript. On Robinhood Chain the Explorer replays a request’s round, drand signature, VRF proof, mapping and transcript from chain data. Verification needs no access to keeper keys.
BUILD WITH THE EVIDENCE