Correlated equilibria are a standard solution concept in game theory and generalize Nash equilibria. In a 2-player non-cooperative game in which player i has action set A_i, a correlated equilibrium is a self-enforcing probability distribution σ over A_1 * A_2. Specifically, when a strategy profile (s_1, s_2) in A_1 * A_2 is sampled according to σ, each player i can observe their own component s_i, but not the other player's component. Knowing s_i and σ, player i cannot increase their expected payoff by defecting and playing a strategy s'_i different from s_i. Correlated equilibria are ubiquitous and crucial in mechanism design, including in the design of blockchain-based protocols which aim to incentivize honest behavior. A correlated equilibrium depends on a centralized and impartial oracle, often called the ''external signal'' in game theory literature, to sample a strategy profile and disclose each player's component to them, while keeping the other player's component secret. However, there is currently no trustless method to achieve this on the blockchain without centralization or relying on trusted third-parties. In this work, we address this challenge and provide two novel protocols, one based on oblivious transfer and the other based on zkSNARKs to replace the public signal with a smart contract. We prove that our approaches are secure and provide the desired privacy properties of a correlated equilibrium, while also being efficient in terms of gas usage and thus affordable in practice.

Decentralized random number generation is a widely-studied problem in the blockchain community and much attention has been paid to the so-called on-chain random beacons, i.e. smart contracts that generate randomness which can in turn be used in other contracts. Following the classical methodology of RANDAO, most on-chain beacons receive inputs from a large number n of participants and then aggregate them to compute a final random output. The aggregation is done in a manner that ensures the final output is uniformly random as long as at least one of the participants acts honestly. While being highly successful in providing security guarantes such as unpredictability and tamper-resistance, a major downside of these beacons is their cost. Since every participant has to call a function in the smart contract to provide their input, the total gas usage to generate a single random number is at least Ω(n). In this work, we propose a novel protocol that offloads most of the on-chain communication between the participants and the smart contract to an alternative off-chain communication with a dealer. This leads to a gas-efficient on-chain random beacon with only O(1) gas usage per generated output. Crucially, our protocol is trustless and the dealer is unable to predict or tamper with the result. We maintain the same security guarantees as previous on-chain beacons, while significantly reducing the gas usage. We also show that our protocol is secure even if all but one of the participants, potentially including the dealer, are dishonest.

Many blockchain protocols and applications require access to a reliable source of distributed random numbers. This has led to the recent interest in the study of distributed random number generation (RNG) and randomness beacons. Numerous approaches have been proposed in the literature, using different cryptographic techniques and working under different assumptions. A problem that has recently been studied is that of generating secret random numbers. There is a natural usecase for this. Suppose a casino CASSIE wishes to offer its gambling games as a smart contract. It is not viable to generate a fresh distributed random number for each bet. Instead, a secret random number should be generated at predefined intervals, e.g. each day, and used as a seed to create the randomness for the whole day. This seed should only be known to CASSIE. Moreover, at the end of the day, CASSIE should be able to disclose the seed and prove that there was no tampering. In this work, we propose a simple and novel distributed random beacon protocol that generates distributed random numbers while preserving secrecy. The generated random number can be used in DeFi applications, such as decentralized casinos, for some time, until it is published along with proof that it is indeed the output of our random beacon. In addition to achieving the desired secrecy property, our approach is also efficient and requires the same amount of computation and communication as non-secret random beacons. Our protocol can easily be implemented as a smart contract.