Verifying a drand beacon is not enough — clients must also recheck the derived integer

A developer building a drand randomness relay found that validating the BLS signature on a beacon does not guarantee the integer value returned to the client is correct. A malicious relay could leave the signature intact while quietly altering the output value, nonce, range, or counter in the JSON response. To close this gap, the client must independently recompute the integer using rejection sampling on the verified beacon data and compare it against the relay's result. The article provides sample code demonstrating how to fetch, verify, and locally recompute the value using a reference drand client. The author also cautions that this approach does not protect against timing attacks or selective disclosure, and is unsuitable for high-stakes or audited draws.