Last Revealer Attack in Blockchain Protocols

• Last Revealer Attack (LRA) is a strategy where the final participant in a commit–reveal protocol uses timing to selectively reveal or withhold its secret, thereby biasing the aggregated randomness.
• The attack exploits protocol design weaknesses, as seen in Ethereum’s RANDAO, where a late participant can calculate favorable outcomes to influence validator selection and committee composition.
• Mitigation methods such as Commit-Reveal², SSS-based schemes, and pMDP optimizations aim to neutralize the timing advantage while balancing trade-offs between liveness and unbiasability.

Last Revealer Attack (LRA) is a strategic manipulation of randomness in commit–reveal and RANDAO-style protocols in which a participant who is scheduled to reveal last waits for all other reveals, computes how their own reveal will affect the final random value, and then either reveals if the outcome is favorable or does not reveal if it is unfavorable, thereby biasing or aborting the randomness. In plain commit–reveal schemes the final value is commonly an aggregation such as $R=\mathcal{H}(s_1\|\dots\|s_n)$ or $R=s_1\oplus\dots\oplus s_n$; in Ethereum’s RANDAO-based randomness generation, an analogous asymmetry appears when late proposers can choose whether to contribute to the final XOR. The attack therefore exploits timing and liveness rather than a break of the underlying hash or signature primitive, and it is consequential for validator selection, committee formation, and other blockchain functions that depend on public randomness (Lee et al., 4 Apr 2025, Son et al., 2024).

1. Definition and basic mechanism

In a standard commit–reveal randomness protocol, each participant $i$ samples a secret $s_i$, computes a commitment $c_i=\mathcal{H}(s_i)$, publishes $c_i$, and later reveals $s_i$. The contract verifies $\mathcal{H}(s_i)\stackrel{?}{=}c_i$, and the final randomness is then computed from the revealed secrets, for example as

$\Omega=\mathcal{H}(s_1\|\dots\|s_n).$

Assuming at least one honest $s_i$ is uniformly random and included, the resulting value is unpredictable before the reveal phase (Lee et al., 4 Apr 2025).

LRA arises when one participant can act with maximal information at the reveal stage. If participants $R=s_1\oplus\dots\oplus s_n$0 commit to secrets and $R=s_1\oplus\dots\oplus s_n$1 reveals last, then after $R=s_1\oplus\dots\oplus s_n$2 and $R=s_1\oplus\dots\oplus s_n$3 have revealed, $R=s_1\oplus\dots\oplus s_n$4 knows $R=s_1\oplus\dots\oplus s_n$5, $R=s_1\oplus\dots\oplus s_n$6, and its own $R=s_1\oplus\dots\oplus s_n$7, and can compute the candidate outcome

$R=s_1\oplus\dots\oplus s_n$8

If that outcome is favorable, $R=s_1\oplus\dots\oplus s_n$9 reveals; if it is unfavorable, $i$0 does not reveal. Depending on the protocol, non-reveal may abort the round or trigger a fallback. The crucial effect is that the last revealer acquires extra power: a “one-bit veto” over whether a particular random outcome occurs (Lee et al., 4 Apr 2025).

The attack is fundamentally enabled by timing and liveness conditions. If the protocol requires all participants to reveal, any participant can abort the round by not revealing. If reveals occur in a fixed or predictable order, a participant or coalition can arrange to reveal last. Even when penalties exist for non-reveal, the stakes of influencing randomness may be high enough that accepting those penalties is rational, so the probability distribution of the output is skewed relative to the ideal uniform distribution (Lee et al., 4 Apr 2025).

2. Manifestation in RANDAO-based blockchain randomness

Ethereum 2.0 uses a RANDAO-based randomness beacon to select block proposers, form committees that attest to blocks, and schedule duties over future epochs. At epoch index $i$1, there are 32 slots, each with a designated proposer. For slot $i$2, the proposer computes a BLS signature on $i$3, and the chain maintains a cumulative XOR of these contributions. If a proposer is absent, Ethereum treats the contribution as zero, so the mixed value remains unchanged (Son et al., 2024).

This structure makes the last proposer in the epoch an archetypal last revealer. Before slot 32, the chain contains

$i$4

The slot-32 proposer can compute its candidate contribution $i$5 and compare two possibilities: reveal, producing

$i$6

or withhold, leaving the final mixed value at $i$7. Because the final assignment function is deterministic once the seed is known, the proposer can simulate both resulting assignments for epoch $i$8 and choose the better one (Son et al., 2024).

When the attacker controls several slots at the tail of the epoch, the manipulation space expands combinatorially. If the attacker controls $i$9 proposers among the last slots, each can independently reveal or not reveal, yielding up to $s_i$0 possible final outcomes. The attack is therefore not limited to a single binary choice; it becomes a search over a set of reachable seeds, each corresponding to a different reveal/non-reveal pattern (Son et al., 2024).

The same logic applies more generally to commit–reveal beacons whose final randomness is an XOR or hash-based aggregation of late-arriving contributions. The distinctive RANDAO feature is that “be absent” is already protocol-native, so withholding is directly expressible as a missing block or zero contribution rather than as a separate protocol exception (Son et al., 2024).

3. Security properties undermined and practical impact

LRA primarily weakens unbiasability. The output is no longer distributed as the honest aggregation of all committed contributions; rather, it is distributed as that aggregation conditioned on the attacker’s strategic reveal choice. In Ethereum’s RANDAO, this means that the final seed is selected from a small attacker-controlled set of alternatives, and unfavorable outcomes can be discarded ex post (Son et al., 2024).

The attack also interacts with liveness. In simple commit–reveal protocols, security is strong if everyone reveals, but liveness is poor because a participant can abort by withholding. In fixed-order or predictable-order schemes, the last revealer can couple this liveness weakness to maximal information, obtaining leverage that earlier revealers do not have. This is the structural reason LRA is more serious than a generic non-participation failure (Lee et al., 4 Apr 2025).

In Ethereum-specific terms, the consequences include bias in block proposer selection, bias in committee composition, and influence on long-term stake dynamics through disproportionate rewards. One cited discussion, recalled in the RANDAO analysis, states that if an attacker had 36% of the total staked money, he would gain control of the Ethereum network; in that context, “control” refers to repeatedly biasing randomness so that proposers and committees are disproportionately drawn from the attacker’s validators (Son et al., 2024).

The quantitative picture in the RANDAO analysis is qualitative rather than entropy-theoretic. It does not provide closed-form probabilities or adversarial advantage bounds, but it does establish the central monotonicity: more attacker-controlled tail slots imply more reachable outcomes and hence greater ability to bias future proposer and committee assignments. This suggests that LRA is best understood as a protocol-level asymmetry that compounds with stake concentration and with the value of downstream random decisions (Son et al., 2024).

4. Mitigation designs within and around commit–reveal

One mitigation is Commit-Reveal$s_i$1, a two-layer commit–reveal protocol in which the first layer is used to randomize the reveal order of secrets in the second layer. Each participant computes

$s_i$2

submits $s_i$3, later reveals $s_i$4, and the protocol computes

$s_i$5

Participants are then sorted in descending order of $s_i$6, so the reveal order for the actual secrets $s_i$7 is determined only after the first-layer reveals are complete. The final randomness is

$s_i$8

The stated goal is to remove the attacker’s ability to guarantee being last or strategically position themselves in the reveal order (Lee et al., 4 Apr 2025).

Commit-Reveal$s_i$9 is presented in a fully on-chain version and a hybrid off-chain leveraged version. In the hybrid design, commitments and first-layer reveals are exchanged off-chain, the leader submits only a Merkle root of commitments on-chain, and finalization verifies the commitment chain $c_i=\mathcal{H}(s_i)$0, the Merkle root, and EIP-712 signatures from activated participants. Measured using Foundry on Cancun EVM and Solidity 0.8.28, the fully on-chain version consumed approximately 569,412 gas for 2 operators and more than 2,484,566 gas for 10 operators, whereas the hybrid model consumed approximately 100,732 gas for 2 operators and approximately 175,569 gas for 10 operators, an over 80% gas reduction (Lee et al., 4 Apr 2025).

A different mitigation, proposed for Ethereum’s RANDAO, replaces direct reveal of each proposer’s BLS signature with a Shamir’s Secret Sharing (SSS)-based scheme. Each proposer splits its signature into shares, encrypts the shares to the other proposers, and includes those encrypted shares in the block. After the epoch, validators decrypt and reveal shares; once at least $c_i=\mathcal{H}(s_i)$1 shares for a secret are available, the system reconstructs the original signature. The key security claim is that a last proposer sees at most one share per previous secret during the epoch and therefore cannot reconstruct the final randomness early enough to condition its participation on the final outcome (Son et al., 2024).

The SSS-based analysis is case-based. When $c_i=\mathcal{H}(s_i)$2 and $c_i=\mathcal{H}(s_i)$3, where $c_i=\mathcal{H}(s_i)$4 is the number of participating proposers and $c_i=\mathcal{H}(s_i)$5 is the number of dishonest proposers, the method can recover all secrets and the attacker cannot predict the digital signatures of other honest proposers; under these “favorable network conditions,” the paper states that LRA is prevented. When $c_i=\mathcal{H}(s_i)$6, no secret can be reconstructed and a backup solution is needed. When $c_i=\mathcal{H}(s_i)$7 and $c_i=\mathcal{H}(s_i)$8, attackers can pool enough shares to recover secrets early and mount an attack similar to LRA, but without needing their proposers to be at the tail of the epoch (Son et al., 2024).

The broader design space includes commit–reveal plus VDF hybrids, VRF-based schemes such as Algorand and Ouroboros, and threshold cryptographic beacons such as RandHound and HydRand. In the related-work positioning of Commit-Reveal$c_i=\mathcal{H}(s_i)$9, plain commit–reveal is simple but directly vulnerable to LRA; VDF hybrids improve resilience to non-reveals but add VDF complexity; VRF-based schemes offer strong unpredictability and unbiasability but use more complex cryptography; and threshold beacons offer strong theoretical guarantees but with high communication and implementation complexity (Lee et al., 4 Apr 2025).

5. Formal optimization and the pseudo-MDP perspective

A later line of work models LRA over repeated epochs as a sequential decision problem rather than as a single-epoch anomaly. In this formulation, the attacker’s state is how many of the last slots in the current epoch it controls, the action is the reveal/withhold pattern on those slots, the transition is the resulting effect of the chosen seed on future proposer assignments, and the reward is the number of successfully proposed blocks minus the opportunity cost of withheld blocks. For Ethereum, the size parameter is $c_i$0, the number of slots per epoch (Reynouard, 8 Oct 2025).

This analysis introduces pseudo-MDPs (pMDPs), a framework for problems with “reversed decision flow”: from an ex-ante state $c_i$1, the environment first generates a set of ex-post options and only then does the attacker choose among them. In the LRA application, $c_i$2 denotes the number of last slots controlled by the attacker, and the number of candidate outcomes is

$c_i$3

because each of the $c_i$4 ending slots may be revealed or withheld independently. A direct ex-post MDP formulation is intractable, with state-space size $c_i$5, and naive value iteration has per-iteration complexity

$c_i$6

By combining ex-post and ex-ante reductions, changing variables from ex-post states to ex-post utilities, and exploiting the IID structure of candidate outcomes, the paper derives a Bellman computation with per-iteration complexity

$c_i$7

while preserving the usual dynamic-programming guarantee of exponentially fast convergence in the number of iterations (Reynouard, 8 Oct 2025).

The same work also simplifies policy extraction. Once the optimal ex-ante value function $c_i$8 over $c_i$9 is known, the attacker can choose in an ex-post state $s_i$0 by maximizing

$s_i$1

over the candidate indices $s_i$2. The worst-case policy extraction complexity for LRA is reduced from

$s_i$3

to

$s_i$4

and the memory requirement is only a vector of size $s_i$5 (Reynouard, 8 Oct 2025).

The economic conclusion of this optimization study is deliberately restrained. Under the assumption that all blocks are equally valued, the optimal strategy yields only a tiny advantage over a myopic strategy; for stake 30%, the additional average reward is roughly 1.5% over the honest baseline, and the myopic strategy obtains almost as much gain as the optimal one. The control-max strategy, which ignores immediate reward and tries only to maximize future control, performs slightly worse than honest in net reward because it sacrifices many immediate blocks. A plausible implication is that computational tractability does not by itself imply large exploit profitability; the profitability depends strongly on the reward model (Reynouard, 8 Oct 2025).

6. Assumptions, residual risks, and terminology

The main mitigation proposals do not claim absolute elimination of the attack. Commit-Reveal$s_i$6 explicitly leaves rigorous cryptographic proofs to future work, and its resistance arguments rely on a collision-resistant hash function, economic incentives and deposits, phase timeouts in a synchronous-enough blockchain environment, and, in the hybrid model, secure authenticated off-chain communication and leader behavior that is at least auditable through signatures, Merkle proofs, and on-chain checks. The paper also states that liveness still depends on behavior and incentives: a coalition can still refuse to reveal, and the effect of collusion depends on how the implementation handles non-reveals (Lee et al., 4 Apr 2025).

The SSS-based RANDAO proposal also has a sharp liveness–security trade-off. A higher threshold $s_i$7 makes early reconstruction by colluding attackers harder, but it also requires more proposers to be present in the reveal phase. If participation drops below threshold, the RNG fails and needs a fallback. If attackers control at least $s_i$8 proposers in an epoch, they can reconstruct secrets early and recover an LRA-like advantage. In that case, the distinctive “last revealer” role dissolves into a threshold-coalition attack (Son et al., 2024).

The pMDP analysis adds a different kind of limitation. It shows that optimal multi-epoch manipulation can be solved efficiently, but the empirical gains remain modest when every block has the same value. The same work notes that richer reward models, such as settings in which some blocks carry higher transaction fees or MEV, may strengthen incentives for strategic withholding. This suggests that the severity of LRA is protocol- and market-dependent rather than fully captured by the equal-reward abstraction (Reynouard, 8 Oct 2025).

A recurring source of confusion is terminological. In cryptography and blockchain protocol analysis, LRA denotes Last Revealer Attack. In nuclear physics, however, LRA can denote long-range alpha, referring to the $s_i$9He particle emitted in ternary fission of heavy nuclei. The acronym is therefore overloaded across disciplines, and the cryptographic meaning should be fixed by context when discussing commit–reveal randomness or RANDAO (Khuyagbaatar, 2024).