Submission Details
Severity:
Flaky randomness in selectWinner()
Summary
Randomness is calculated using on-chain information in selectWinner()
Vulnerability Details
Anyone can call the selectWinner() function and because the winner is selected by using on-chain information the "random" index of the winner could be predicted. Additionally in PoS the block.difficulty==0 always additionally making the randomness wicker.
Impact
Winner's index could be engineered.
Tools Used
Manual review
Recommendations
Use Chainlink VRF for randomness
Updates
Lead Judging Commences
Hamiltonite almost 2 years ago
Submission Judgement Published Assigned finding tags:
weak-randomness
Root cause: bad RNG Impact: manipulate winner
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.