> ## Documentation Index
> Fetch the complete documentation index at: https://docs.roll.codes/llms.txt
> Use this file to discover all available pages before exploring further.

# Callback security

> Apply the core security checks every roll.codes consumer callback should enforce.

Your callback is the trust boundary between roll.codes and your contract logic. Keep it small, explicit, and defensive.

## Required checks

<Steps>
  <Step title="Authorize the caller">
    Only accept callbacks from the configured coordinator address.
  </Step>

  <Step title="Look up request state">
    Load the record for `requestId` and reject unknown requests.
  </Step>

  <Step title="Prevent duplicate settlement">
    Reject callbacks for requests you have already settled.
  </Step>

  <Step title="Settle outcome deterministically">
    Derive the result, persist state, and avoid unnecessary external calls.
  </Step>
</Steps>

## Minimal guard pattern

```solidity theme={null}
function randomNumberCallback(uint256 requestId, uint256 randomNumber) external {
    if (msg.sender != address(vrfSystem)) revert Unauthorized();

    Pending storage request = pendingByRequestId[requestId];
    if (request.player == address(0)) revert RequestNotFound(requestId);
    if (request.settled) revert AlreadySettled(requestId);

    request.settled = true;
    request.randomNumber = randomNumber;
}
```

## What to avoid

* callbacks that make unrelated external calls before marking state
* large amounts of branching that increase revert risk
* deriving user-visible state before verifying the request exists
* relying on frontend state instead of contract state during settlement

## Verification checklist

* The deployed coordinator address matches the network you are using.
* Unknown request IDs revert.
* Duplicate settlement reverts.
* The callback succeeds reliably within the gas supplied by the delivery transaction.

## Related pages

<CardGroup cols={2}>
  <Card title="Coordinator reference" icon="file-text" href="/contracts/coordinator-reference">
    Look up the request function, `requestFee()` call, and callback interface.
  </Card>

  <Card title="Integration pattern" icon="blocks" href="/contracts/integration-pattern">
    Start from a complete example that already applies these checks.
  </Card>

  <Card title="Quickstart" icon="rocket" href="/quickstart">
    Use the hosted-coordinator setup flow before you harden your callback.
  </Card>
</CardGroup>