Verifiable Delay Function (VDF)

What Is a Verifiable Delay Function (VDF)?

A Verifiable Delay Function (VDF) is a cryptographic function that takes a predictable amount of sequential time to compute but can be verified quickly by anyone.

In crypto, a VDF is useful because it can prove that a certain delay really passed before an output was produced.

The original Verifiable Delay Functions paper by Boneh, Bonneau, Bünz, and Fisch explains that a VDF requires a specified number of sequential steps to evaluate, yet produces a unique output that can be efficiently and publicly verified.

This makes a VDF different from a normal hash, because a normal hash can usually be computed quickly and in parallel by many machines.

A VDF is designed so that even an attacker with many computers cannot easily skip the waiting period.

The key idea is sequentiality.

Each step depends on the step before it, so adding more machines should not make the computation much faster.

For beginners, the simplest definition is this: a Verifiable Delay Function is a crypto tool that creates a publicly checkable waiting period.

Why VDFs Matter in Crypto

VDFs matter because blockchains often need fair timing, unbiased randomness, and manipulation-resistant ordering.

Randomness is difficult on a blockchain because all nodes must agree on the same result.

If randomness can be predicted or influenced too early, validators, miners, bots, or insiders may gain an unfair advantage.

VDFs can help by delaying the final output until after participants have already committed to their actions.

This can reduce manipulation in leader selection, committee selection, lotteries, NFT mints, game outcomes, fair sequencing, and randomness beacons.

VDFs are also relevant to proof-of-space-and-time systems, where a network needs evidence that time has passed after storage commitment.

The official Chia Proof of Time documentation describes a VDF as a proof that a sequential function was executed a certain number of times.

This shows that VDFs are not only theoretical.

They have real blockchain design applications, although they are still complex and not widely used in every network.

How a VDF Works

A VDF usually has three core parts.

The first part is setup.

Setup defines public parameters and a delay target.

The second part is evaluation.

Evaluation takes an input and performs a sequence of operations that cannot be meaningfully parallelized.

The third part is verification.

Verification checks that the output is correct without repeating the full slow computation.

This difference between slow evaluation and fast verification is the main value of a VDF.

A prover spends time computing the result.

A verifier checks the result efficiently.

In blockchain systems, this means many nodes can verify the proof without all of them wasting the same amount of time.

A useful VDF should be slow enough to create a real delay, but cheap enough to verify at scale.

If verification is too expensive, the VDF becomes impractical for blockchains.

Core Properties of a VDF

A secure VDF should have sequential computation.

This means the fastest known way to compute the output requires step-by-step work.

A secure VDF should have efficient verification.

This means anyone can check the result much faster than computing it from scratch.

A secure VDF should have a unique output.

This means a given input should have only one valid output.

Uniqueness is important because it prevents a prover from choosing among many possible outputs.

A secure VDF should also resist parallel speedups.

This means an attacker cannot simply buy thousands of machines and finish much earlier.

A practical VDF should also have clear parameters.

If the delay is too short, attackers may gain an advantage with faster hardware.

If the delay is too long, the system may become slow and unpleasant to use.

VDF vs. VRF

A VDF is different from a Verifiable Random Function, or VRF.

A VRF creates a pseudorandom output and proof from a secret key and input.

The official Chainlink VRF documentation describes VRF as a provably fair and verifiable random number generator that allows smart contracts to access random values.

A VRF is useful when a system needs verifiable randomness from a known cryptographic source.

A VDF is useful when a system needs a delay that is difficult to skip.

VRFs focus on verifiable randomness.

VDFs focus on verifiable time delay.

The two can also be combined.

For example, a protocol may use a VRF or commit-reveal system to create an input, then pass that input through a VDF to reduce manipulation.

This combination can make randomness harder to bias because participants cannot instantly know the final result at the moment of commitment.

VDF vs. Proof of Work

A VDF is also different from proof of work.

Proof of work can usually be parallelized because many miners can try different hashes at the same time.

This is why proof-of-work mining rewards whoever finds a valid solution first among many parallel attempts.

A VDF is designed to be sequential.

More hardware should not reduce the delay by the same kind of large factor.

Proof of work proves that computational effort was spent.

A VDF proves that a certain sequential delay was passed.

Proof of work is often used for consensus and block production.

VDFs are often proposed for randomness, timing, and fairness.

Both use computation, but they solve different problems.

Confusing VDFs with proof of work can lead to poor blockchain design assumptions.

VDF vs. Time-Lock Puzzle

VDFs are related to time-lock puzzles, but they are not exactly the same thing.

A time-lock puzzle is designed so that a secret or message can only be revealed after a certain amount of computation.

A VDF adds efficient public verification of the delayed output.

This verification property is important for blockchain systems because many nodes need to check results quickly.

Older time-lock ideas inspired many VDF constructions.

Modern VDF research often uses repeated squaring in groups of unknown order, proof of exponentiation, or related mathematical tools.

The Stanford survey of Pietrzak and Wesolowski VDFs explains that these practical VDFs are based on proof-of-exponentiation techniques.

For users, the main takeaway is simple.

A time-lock puzzle creates delay, while a VDF creates delay plus efficient public verification.

VDFs and Blockchain Randomness

Randomness is one of the most important blockchain use cases for VDFs.

Blockchains need randomness for validator selection, committee assignment, leader election, NFT reveals, gaming, lotteries, and protocol sampling.

However, blockchain randomness can be attacked if one participant can choose whether to reveal or withhold information after seeing the effect.

This is called bias or last-revealer manipulation.

A VDF can reduce this problem by delaying the final random output.

After participants commit to a seed, the VDF creates a delay before the final randomness is known.

This gives attackers less ability to choose among favorable outcomes at the last moment.

The Ethereum Foundation has researched VDFs for randomness, and an Ethereum Foundation ecosystem support update described VDFs as the basis for unbiasable randomness in Ethereum research.

This does not mean VDFs are automatically used everywhere today.

It means they are important in the research path for more manipulation-resistant randomness.

VDFs and Ethereum

Ethereum has studied VDFs for randomness, especially in earlier proof-of-stake and beacon-chain research.

Current Ethereum validator selection uses RANDAO rather than a deployed VDF-based beacon.

The official Ethereum block proposal documentation explains that Ethereum achieves validator-selection randomness using RANDAO, which mixes a block proposer’s hash with a seed that updates every block.

This distinction matters because some older Ethereum research documents discuss RANDAO plus VDF designs.

Those ideas remain important, but users should not assume that every researched VDF proposal is live on Ethereum mainnet.

VDFs remain relevant to Ethereum because randomness quality affects validator selection, proposer predictability, MEV opportunities, committee sampling, and future protocol design.

Ethereum researchers continue to study ways to improve randomness, reduce manipulation, and protect validator selection.

A VDF could be one possible tool in that broader design space.

However, Ethereum protocol changes require research, engineering, audits, client implementation, testing, and social consensus.

A VDF idea is not the same as a scheduled upgrade.

VDFs and Chia Proof of Time

Chia is one of the clearest examples of a blockchain that uses VDF-like proof-of-time concepts in production.

Chia combines proof of space with proof of time.

Farmers provide storage proofs, while timelords produce proofs of time using VDFs.

The official Chia Timelord documentation explains that a Timelord broadcasts a proof of time using a VDF to prove that time has passed since the last challenge.

This design uses VDFs as part of consensus timing rather than only as an external randomness tool.

The idea is that storage proves resource commitment, and the VDF proves elapsed sequential time.

This helps prevent a participant from instantly generating many alternative histories without waiting.

Chia’s use case shows why VDFs are often described as proof of time.

They do not measure time by a wall clock alone.

They prove that a required sequential computation was performed.

VDFs and Filecoin Research

Filecoin and the Ethereum Foundation have also collaborated on VDF research.

The official Filecoin collaboration post on VDFs describes a joint research effort with the Ethereum Foundation around VDFs and their practical challenges.

Filecoin is especially relevant because decentralized storage networks need randomness, proofs, and incentives that are hard to manipulate.

However, Filecoin’s current public randomness ecosystem is also closely connected to drand.

The official Filecoin drand documentation explains that drand is used as a randomness beacon for leader election in Filecoin.

This is useful for comparison because drand is not the same as a VDF.

Drand uses distributed threshold cryptography to produce public randomness at fixed intervals.

A VDF uses sequential computation to impose delay and provide a verifiable output.

Both can support randomness designs, but they use different security models.

VDFs and Randomness Beacons

A randomness beacon is a service or protocol that outputs public random values at regular intervals.

Blockchains can use randomness beacons for leader election, committee selection, gaming, lotteries, airdrops, sampling, and cryptographic protocols.

A VDF-based randomness beacon can take a seed and delay the final output so that no participant can instantly know or choose the result.

This can reduce manipulation in systems where future randomness has economic value.

The official drand documentation describes drand as a distributed randomness beacon that generates publicly verifiable, unbiased, and unpredictable random values at fixed intervals.

Drand and VDFs are different approaches, but both show why public randomness is a serious infrastructure problem.

In crypto, randomness is not only for games.

It can affect who proposes blocks, who earns rewards, who receives NFTs, who gets selected for committees, and who can exploit MEV.

This makes randomness design a security issue, not only a convenience feature.

VDFs and MEV

MEV means Maximal Extractable Value.

It refers to value that can be gained by ordering, including, excluding, or reordering transactions.

VDFs can matter for MEV because predictable randomness and predictable ordering can give sophisticated actors an advantage.

If a validator or searcher can know future randomness before others, they may position themselves for profit.

If a lottery, NFT reveal, or validator selection process can be predicted too early, bots may exploit it.

A VDF can reduce some forms of early knowledge by forcing everyone to wait for the final output.

This does not eliminate MEV by itself.

MEV also depends on transaction ordering, block building, private mempools, latency, liquidity, oracle updates, and protocol rules.

A VDF is one possible tool for reducing manipulation in randomness-dependent systems.

It is not a complete MEV solution.

VDFs and Fair Sequencing

Fair sequencing means arranging transactions or actions in a way that reduces unfair ordering advantages.

In decentralized exchanges, NFT mints, auctions, and games, ordering can strongly affect outcomes.

If one party can see pending actions and act before others, users may face front-running or manipulation.

A VDF can support fairer designs by delaying the revelation of certain information until after commitments are locked in.

For example, users may submit commitments first, and a VDF output may later determine ordering or reveal outcomes.

This approach can make it harder for participants to adapt instantly after seeing other users’ actions.

However, fair sequencing is a broad problem.

It may also require encrypted mempools, threshold encryption, commit-reveal schemes, batch auctions, proposer-builder separation, and governance rules.

A VDF can help with timing, but it does not solve all ordering problems alone.

VDFs and NFT Reveals

VDFs can be useful in NFT reveals when a collection wants to assign traits fairly after minting.

If the reveal randomness can be influenced by the creator, miner, validator, or last participant, rare NFTs may be unfairly assigned.

A VDF can delay the final randomness so that no one can immediately know the reveal result at the time of minting.

This can support fairer trait assignment when combined with a good commit-reveal process.

However, VDFs are not magic fairness machines.

The NFT contract still needs correct code, transparent metadata handling, fixed supply rules, and trustworthy reveal logic.

If metadata can be changed after the VDF output, the fairness benefit may disappear.

If the project team can alter traits manually, the VDF may only create a false sense of security.

A fair NFT reveal needs both cryptographic randomness and honest metadata controls.

Users should inspect the whole reveal design, not only whether a VDF is mentioned.

VDFs and On-Chain Games

On-chain games often need randomness for battles, loot drops, map generation, matchmaking, card draws, and rewards.

A weak randomness source can be exploited by bots or advanced users.

A VDF can help when the game needs delayed randomness that players cannot know in advance.

For example, players may commit moves before a delayed random value determines the outcome.

This can reduce the chance that a player chooses an action after secretly knowing the final randomness.

However, games also care about speed and user experience.

A VDF delay that is acceptable for validator selection may be too slow for a fast game.

Game designers must balance fairness, latency, cost, and player experience.

In many cases, VRFs, commit-reveal systems, or off-chain game servers may be used instead.

A VDF is most useful when delay itself is part of the security goal.

VDFs and Timelock Encryption

Timelock encryption lets data stay encrypted until a future time or future event.

VDFs can support this idea because they make it difficult to compute a decryption-related value before a delay passes.

Timelock encryption can be useful for sealed-bid auctions, delayed governance reveals, fair launches, private commitments, and staged disclosures.

Drand also supports timelock encryption through a different design.

The official drand timelock encryption documentation explains a timelock scheme that encrypts data using a future round’s random value.

This comparison is useful because not every timelock system uses a VDF.

Some rely on distributed randomness networks.

Others rely on sequential computation.

The shared goal is delayed access to information.

In crypto, delayed information can support fairness when early knowledge would create an advantage.

VDF Construction Methods

Many practical VDF designs use repeated squaring in groups of unknown order.

This means the evaluator repeatedly squares a value many times in a mathematical group where no party knows a shortcut based on the group order.

Pietrzak and Wesolowski VDFs are two important proof-of-exponentiation-based approaches.

The Wesolowski efficient VDF paper constructs a VDF where evaluation requires a given number of sequential steps and the result can be efficiently verified.

Other VDF research studies class groups, RSA groups, trusted setup concerns, proof size, verification cost, and hardware acceleration.

These details are technical, but they matter because blockchain systems need both security and practicality.

A VDF that is elegant on paper may still be too expensive, too slow, or too hard to parameterize safely.

Good VDF design requires cryptography, hardware awareness, and protocol economics.

VDF Hardware and ASICs

Hardware matters for VDFs because the delay depends on how fast the best available machine can compute the sequential function.

If one attacker has much faster hardware than everyone else, they may finish the VDF early and gain an advantage.

This is why VDF parameter selection is hard.

A delay that looks safe on normal hardware may be unsafe against specialized hardware.

Some VDF research has explored custom hardware and ASIC design.

The official VDF Research site collects research on verifiable delay functions, hardware design, and related cryptographic work.

Hardware uncertainty is one reason VDF deployment is difficult in high-value blockchain systems.

Protocols must assume attackers may invest in faster devices if the reward is large enough.

This creates an economic security problem, not only a cryptographic problem.

A secure VDF must be difficult to shortcut both mathematically and economically.

Economic Security of VDFs

Economic security means a VDF delay must be safe against attackers who are willing to spend money for an advantage.

In blockchain systems, attackers may buy specialized hardware if early knowledge of randomness creates profit.

This profit may come from MEV, validator selection, NFT trait manipulation, auction outcomes, lottery prizes, or governance timing.

A recent paper on economic security of VDF-based randomness beacons argues that VDF delay parameters should consider rational attackers, hardware speedups, operating costs, and reward spikes.

This is important because a VDF can be cryptographically sequential but still economically weak if the reward for beating the delay is too large.

A protocol should not choose VDF parameters only by measuring average hardware.

It should ask how much an attacker could earn by being faster.

If the reward is high enough, even small speed advantages can matter.

Crypto security must consider incentives as well as math.

Benefits of VDFs

The first benefit of a VDF is verifiable delay.

Anyone can check that the output is valid without recomputing the full delay.

The second benefit is resistance to parallel shortcuts.

A well-designed VDF should not become much faster just because an attacker uses many machines.

The third benefit is better randomness fairness.

A VDF can reduce last-mover bias in commit-reveal or beacon systems.

The fourth benefit is public verification.

Blockchain nodes, smart contracts, or users can verify the proof rather than trusting one party.

The fifth benefit is timing-based security.

Some protocols need proof that a certain time-like computation happened before the next step.

The sixth benefit is support for decentralized applications.

VDFs can help lotteries, games, auctions, NFT reveals, validator selection, and fair sequencing designs.

Risks and Limitations of VDFs

The first risk is implementation complexity.

VDFs are advanced cryptographic tools that require careful engineering.

The second risk is hardware advantage.

An attacker with faster specialized hardware may reduce the effective delay.

The third risk is bad parameter selection.

A delay that is too short may not protect the protocol, while a delay that is too long may hurt usability.

The fourth risk is trusted setup.

Some VDF designs require setup assumptions that must be handled carefully.

The fifth risk is verification cost.

A proof that is too expensive to verify may not be practical on-chain.

The sixth risk is false marketing.

A project may claim to use a VDF without explaining whether the implementation is secure, audited, or relevant.

The seventh risk is incomplete threat coverage.

A VDF can reduce timing manipulation, but it cannot fix bad tokenomics, oracle risk, wallet theft, smart contract bugs, or governance capture.

Common Misunderstandings About VDFs

One common misunderstanding is that a VDF creates randomness by itself.

A VDF delays and verifies computation, but the input seed still matters.

Bad input randomness can still create weak output randomness.

Another misunderstanding is that more computers can always compute a VDF faster.

A secure VDF is designed so that parallel computation does not give a large shortcut.

Another misunderstanding is that VDFs are the same as VRFs.

VRFs provide verifiable pseudorandomness, while VDFs provide verifiable delay.

Another misunderstanding is that VDFs automatically stop all MEV.

They can reduce some manipulation around delayed randomness, but they do not solve every ordering or extraction problem.

Another misunderstanding is that every VDF proposal is production-ready.

Many VDF ideas are still research-heavy and require careful testing before securing valuable systems.

How to Evaluate a Crypto Project Using a VDF

Start by checking why the project needs a VDF.

A VDF should solve a real timing, fairness, or randomness problem.

Then check whether the project explains the input source.

A delayed function is only useful if the input cannot be easily controlled by attackers.

Check whether the VDF construction is known and peer-reviewed.

Check whether verification happens on-chain, off-chain, or through a trusted service.

Check whether the verification cost is practical for users and validators.

Check whether the delay parameter is justified against specialized hardware.

Check whether the implementation has been audited.

Check whether the VDF output can still be overridden by admin keys, metadata changes, oracle controls, or governance decisions.

A VDF is only one part of a secure protocol design.

The surrounding system must also be secure.

VDF in Simple Terms

A Verifiable Delay Function is like a cryptographic timer.

It forces someone to spend a real amount of sequential time computing an output.

After the output is produced, everyone else can check it quickly.

This is useful when crypto systems need fair randomness or delayed information.

A VDF can help stop one participant from instantly knowing or choosing the final result.

It can support validator selection, randomness beacons, NFT reveals, auctions, games, and proof-of-time systems.

However, a VDF is not a simple plug-in feature.

It needs strong cryptography, correct implementation, careful parameter choices, and economic security analysis.

For beginners, the main rule is simple.

A VDF proves that a delay happened, but the whole protocol must still be designed safely.

FAQ

What does Verifiable Delay Function mean?

A Verifiable Delay Function is a cryptographic function that takes a required amount of sequential time to compute but can be verified quickly.

What does VDF stand for?

VDF stands for Verifiable Delay Function.

Why are VDFs useful in crypto?

VDFs are useful for delayed randomness, fair leader selection, proof of time, NFT reveals, auctions, games, and manipulation-resistant protocol design.

Does a VDF generate randomness by itself?

No, a VDF delays and verifies computation, but it usually needs an input seed from another randomness or commitment process.

What is the main property of a VDF?

The main property is that computation must be sequential and slow, while verification should be fast.

Is a VDF the same as a VRF?

No, a VRF provides verifiable pseudorandom output, while a VDF provides a verifiable time delay.

Is a VDF the same as proof of work?

No, proof of work can be massively parallelized, while a VDF is designed to resist parallel speedups.

How can VDFs help blockchain randomness?

They can delay the final randomness output so participants have less ability to bias or manipulate the result after seeing partial information.

Does Ethereum use a VDF today?

Ethereum has researched VDFs, but current validator-selection randomness uses RANDAO rather than a deployed VDF-based randomness beacon.

Does Chia use VDFs?

Yes, Chia uses proof-of-time concepts based on VDFs as part of its consensus design.

Can VDFs reduce MEV?

They can reduce some randomness-related manipulation, but they do not solve all MEV or transaction-ordering problems.

Can smart contracts verify VDFs?

Some VDF proofs can be verified by smart contracts, but verification cost and implementation complexity must be considered.

What is a VDF proof?

A VDF proof is evidence that the delayed computation was performed correctly.

Why does VDF hardware matter?

Hardware matters because faster specialized devices may reduce the real-world delay and create unfair advantages.

What is a VDF randomness beacon?

A VDF randomness beacon is a system that uses VDFs to produce public randomness after a verifiable delay.

Can VDFs be used for NFT reveals?

Yes, they can help make NFT trait reveals harder to manipulate when combined with a secure commit-reveal and metadata process.

Are VDFs production-ready for every blockchain?

No, VDFs are powerful but complex, and each use case needs careful cryptographic, economic, and engineering review.

What is the biggest risk of a VDF?

The biggest risk is assuming that the VDF alone makes a protocol fair, when the input source, parameters, implementation, and surrounding rules may still be weak.

Conclusion

A Verifiable Delay Function (VDF) is one of the most important cryptographic ideas for blockchain timing, randomness, and fairness.

It creates a delay that is hard to skip and easy to verify.

This makes it useful when a protocol needs to prevent participants from learning or manipulating an outcome too early.

VDFs can support randomness beacons, validator selection, committee sampling, NFT reveals, on-chain games, auctions, fair sequencing, timelock systems, and proof-of-time consensus designs.

They are especially valuable because blockchains are transparent and deterministic, which makes secure randomness difficult.

However, VDFs are not magic.

They do not create good randomness from bad inputs.

They do not eliminate every MEV problem.

They do not remove smart contract risk.

They do not guarantee fairness if the surrounding protocol has admin controls, weak metadata rules, bad incentives, or poor implementation.

A secure VDF system needs strong cryptographic assumptions, efficient verification, careful delay parameters, hardware-aware design, and economic security analysis.

Projects that mention VDFs should explain exactly how the VDF is used, what input it receives, who computes it, who verifies it, and what happens if the proof is delayed or missing.

For crypto users, the best way to understand a VDF is to think of it as a public cryptographic clock.

It proves that time-like sequential work happened before the next result was accepted.

Used correctly, that delay can make decentralized systems fairer and harder to manipulate.

Used carelessly, it can become a technical buzzword that hides weak protocol design.