Summary

REQUEST_CONFIRMATIONS determines the number of blocks to wait between requesting a random number and the VRF coordinator supplying that number. It needs to be set high enough to make chain reorganizations infeasible compared to the economic payoff. The current value of 3 may be too low for Ethereum main-net and Arbitrum.

Vulnerability Details

Since Ethereum's upgrade to POS, finality on Ethereum is achieved after 65 blocks ( https://developers.circle.com/stablecoins/docs/required-block-confirmations ). The same number of blocks is recommended for Arbitrum.

Impact

Low: Gaming the randomness generator by reorging the chain would require malicious validator and/or a block builder responsible for multiple blocks in a row. This is unlikely given the limited economic advantage that could be gained by this attack.

Tools Used

Manual code inspection.

Recommendations

Increase REQUEST_CONFIRMATIONS to 65.