Submission Details
Severity:
Predictable Winner Randomness
Summary
Using block.timestamp and block.difficulty to determine the winner is not 100% secure.
Vulnerability Details
By using block.timestamp and block.difficulty to determine the winning player index could be predictable as well as exploitable.
Impact
Medium.
This is a valid bug but the exploitation of it needs multiple miners to succeed so the cost to exploit this would outweigh the gains made by it.
Tools Used
Vs Code
Recommendations
Always use a off-chain oracle like chainlink to get true randomness that cant be altered by on-chain tactics.
Updates
Lead Judging Commences
Hamiltonite almost 2 years ago
Submission Judgement Published Assigned finding tags:
weak-randomness
Root cause: bad RNG Impact: manipulate winner
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.