Beginner FriendlyFoundryNFT
100 EXP
View results
Submission Details
Severity: high
Valid

selectWinner is not random and can be predicted

Summary

SelectWinner is not random and can be predicted.

Vulnerability Details

Since POS, block.difficulty is not actually random, and msg.sender and block.timestamp are known, so we can easily calculate winnerIndex and the transaction to be run at a predicted block.

Impact

Winner can be choose with a transaction initiated at a specific block.

Tools Used

Recommendations

Use a "real" random function like Chainlink VRF.

Updates

Lead Judging Commences

patrickalphac Lead Judge
over 1 year ago
Hamiltonite Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

weak-randomness

Root cause: bad RNG Impact: manipulate winner

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.