ZKasino Security Update Post Mortem

**Executive Summary:** ZKasino's betting contracts depend on a third-party RNG oracle; if the oracle's callback (rawFulfillRandomWords) is delayed beyond the refund window, attackers can observe pending transactions in the mempool and front-run refunds to reclaim wagers that would otherwise lose, allowing financial manipulation. CertiK previously flagged this operational dependency (informational) and ZKasino has extended the refund window from 100 to 200 blocks and will monitor gas to reduce callback failures.