Lessons from the Dark Forest
by zomglings, Moonstream DAO
Act I of Crypto Unicorns: The Dark Forest is coming to a close. What started off as a “wouldn’t it be cool if…” conversation between me and Aron in November became one of the first and one of the most successful fully on-chain play-to-earn minigames on web3.
The Dark Forest has had a massive impact on the Crypto Unicorns community (with over 92% of all unicorns being staked into the Dark Forest at least once). It has also had a significant impact on Moonstream. The Dark Forest gave rise to the Shadowcorns, the Crypto Unicorns’ first antagonists. It inspired a new Moonstream product called Moonstream Lootbox, which saw its alpha release last week and was used for the RBW airdrop.
There were hard times during the operation of the Dark Forest, too. A couple of weeks into the opening of the Dark Forest, a Crypto Unicorns community member reported an exploit on the contract. When a player sacrificed UNIM to earn a chance at receiving a Shadowcorn egg, the Dark Forest requested randomness for Chainlink. It stored this randomness in smart contract state until the player completed their sacrifice, at which point it would use the randomness to decide which reward to give them.
Get Moonstream.to’s stories in your inbox
Join Medium for free to get updates from this writer.
The exploit was that players could inspect the randomness in state and wait until conditions — the number of remaining Shadowcorn eggs of each type — were favorable for them to earn mythic or rare Shadowcorn eggs.
Fortunately, at the time that this exploit was found, rarity snipers had to wait a long time — hours — to profit from it. Within 30 minutes of the exploit being reported, the Moonstream team put a mitigation in place. We monitored all open sacrifices using the Moonstream API. If a sacrifice was open for too long, we deemed it to be part of a snipe attempt and nixed the sacrifice. This strategy worked well, with minor tweaks throughout the run of the Dark Forest. The snipers lost about as much in UNIM from countersniped sacrifices than they gained from their sniping activity.
At Moonstream, we have always been strong advocates for free software and for transparency with our users and our community. Overnight, the Dark Forest contract which we built came to represent hundreds of millions of dollars of economic value. We realized that being as transparent as we had been prior to its release would be at odds with our duty to secure the value and trust that our users place in Moonstream. In response, we have adopted a policy of being open about our tooling but secretive about our operations.
We also learned a valuable lesson in using on-chain randomness. In the future, all our contracts that use randomness will use the randomness independently of any other contract state. If that is not possible, they will resolve the game mechanic in the same transaction that the randomness is resolved.
Even this experience caused Moonstream to grow. The tools we created to detect and combat the snipers have blossomed into a world-class security framework for blockchain games and economies that is protecting billions of dollars in value across multiple economies.
Crypto Unicorns: The Dark Forest has expanded the frontiers of possibility in web3 gaming. It has been a pleasure building it in collaboration with the team at Laguna Games. We look forward to building more entertaining experiences for the Crypto Unicorns community in the future!
