First Flight #10: One Shot
First Flight #10
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Randomness logic makes the outcome predicatable

abhishekthakur

Summary

Randomness result is predictable due to the variables used for generating randomness.

Vulnerability Details

_battle function has following line to calculate randomness -

uint256 random =
uint256(keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender))) % totalBattleSkill;

block.timestamp is in control of miners (miner can hold a tx for next block or two), Other params also known ahead of time. which can used to make outcome to there favor. Consider using chainlink VRF for generating randomness.

Impact

Predictable randomness make it possible to calculate the winner ahead of execution.

Tools Used

Manual Review, Foundry

Recommendations

Use of Chainlink VRF to generate randomeness.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Weak Randomness

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.