# A failed callback should not give an onchain game a second roll

Canonical: https://chainincident.com/news/9619d817-757e-4fd5-9d86-91eda2f631ff
Published: 2026-09-20T19:00:04.283Z
Publisher: Chain Incident

A randomness service can accept a valid proof even when the game's receiving function fails. Treating that failure as permission to request a different result can introduce a new problem: an application may end up selecting among outcomes instead of honoring the original draw.

*Security explainer | Documentation reviewed September 17, 2026.*

A randomness service can accept a valid proof even when the game's receiving function fails. Treating that failure as permission to request a different result can introduce a new problem: an application may end up selecting among outcomes instead of honoring the original draw.

Chainlink's VRF security guidance warns against cancellation or re-request patterns that allow randomness to be discarded. The broader design principle also matters when evaluating other providers.

D20DAO documents a useful separation between proof acceptance and callback delivery. Once a proof is accepted, its retry mechanism sends the same stored result again. It does not generate a replacement draw, and delivery retry does not earn another service fee. A failed callback alone does not qualify for the unfulfilled-request refund.

Requests without an accepted proof instead become eligible for a refund transaction after the 60-second deadline. The refund uses the ratio fixed when the request was created; gas and application payments are outside that refund. Game developers must therefore define what happens to a player's stake or purchase separately.

This is a constructive recovery pattern, not a security certification. D20DAO remains dependent on its operator and trusted upgrade authority, and its contracts have not received an external audit.

Sources: [Chainlink VRF security considerations](https://docs.chain.link/vrf/v2-5/security), [D20DAO service rules](https://d20dao.org/docs/service-rules), [security model](https://d20dao.org/docs/security), [SDK audit statement](https://www.npmjs.com/package/@d20dao/vrf-sdk).

Related reading: [What a verifiably random game proves, and what players still need to check](https://tokenprimer.com/news/6b2d0cc1-17e5-4bba-89eb-451c7ef2cf6b); [D20DAO reports 470 Arc testnet requests completed within its 60-second deadline](https://forkbrief.com/news/82a01df1-4bfc-4ba3-95fa-579f3e2e62f0).

## Sources

- [What a verifiably random game proves, and what players still need to check](https://tokenprimer.com/news/6b2d0cc1-17e5-4bba-89eb-451c7ef2cf6b) — Token Primer
- [VRF Security Considerations | Chainlink Documentation](https://docs.chain.link/vrf/v2-5/security) — Chainlink
- [D20DAO VRF SDK documentation](https://www.npmjs.com/package/@d20dao/vrf-sdk) — D20DAO
- [D20DAO reports 470 Arc testnet requests completed within its 60-second deadline](https://forkbrief.com/news/82a01df1-4bfc-4ba3-95fa-579f3e2e62f0) — Fork Brief
- [Skip to content](https://d20dao.org/docs/security) — D20DAO
- [Skip to content](https://d20dao.org/docs/service-rules) — D20DAO

- [Editorial policy](https://chainincident.com/editorial-policy)
- [Request a correction](https://chainincident.com/corrections)