Submission Details
Severity:
RNG not truly random
Summary
Random number generator (RNG) is not truly random and miners can interfere with the winner selection.
Vulnerability Details
Since on-chain data is used (such as block.timestamp and block.difficulty), theoretically, miners could interfere and possibly select themselves as winners, due to their access to protocol-level variables, such as block.
Impact
High risk, low likelyhood
Tools Used
Manual inspection.
Recommendations
Use verifiably and truly random numbers, such as RANDAO or Chainlink's VRF, to select winners.
Updates
Lead Judging Commences
Hamiltonite almost 2 years ago
Submission Judgement Published Assigned finding tags:
weak-randomness
Root cause: bad RNG Impact: manipulate winner
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.