Summary

Insecure randomness that use block timestamp and address as input.

Vulnerability Details

Since the malicious user can manipulate the block.timestamp or use certain msg.sender address value to manipulate the final result.

Impact

Hacker can get rarity NFT as much as possible if the value is block.timestamp and block.difficulty is manipulated.

Tools Used

manual review

Recommendations

Use Chainlink VRF to get random number from off-chain method.