Inadequate randomness employed in contract.
Summary
Both the winnerIndex and rarity can be calculated before initiating the call, thus exploiting who becomes the winner and the rarity of the NFT.
Vulnerability Details
The winnerIndex and rarity are calculated on the basis of the caller address, timestamp and difficulty. All of these parameters can be known prior to initiating the call, thus allowing the caller to win in almost all cases.
Impact
Winning by exploiting the randomness in all cases.
Tools Used
Manual Review
Recommendations
True randomness is difficult to achieve in blockchain natively, thus using services like chainlink VRF, etc is recommended.
Lead Judging Commences
weak-randomness
Root cause: bad RNG Impact: manipulate winner
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.