Callback security

​

Required checks

​

Minimal guard pattern

function randomNumberCallback(uint256 requestId, uint256 randomNumber) external {
    if (msg.sender != address(vrfSystem)) revert Unauthorized();

    Pending storage request = pendingByRequestId[requestId];
    if (request.player == address(0)) revert RequestNotFound(requestId);
    if (request.settled) revert AlreadySettled(requestId);

    request.settled = true;
    request.randomNumber = randomNumber;
}

​

What to avoid

• callbacks that make unrelated external calls before marking state
• large amounts of branching that increase revert risk
• deriving user-visible state before verifying the request exists
• relying on frontend state instead of contract state during settlement

​

Verification checklist

• The deployed coordinator address matches the network you are using.
• Unknown request IDs revert.
• Duplicate settlement reverts.
• The callback succeeds reliably within the gas supplied by the delivery transaction.

​

Related pages