First Flight #10: One Shot

Summary

Hashing msg.sender, block.timestamp and block.prevrandao together creates a pedictable find number. A prdicatable number is not good random number. Malicious users can manipulate these values or know them ahead of time to choose the winner of the RapBattle

This means user could wait for when the number processed favours them to call goOnStageOrBattle()

Vulnerability Details

1. Validators can know the variables used to there advantage,

2. Users can mine/manipulate their msg.sender value to result in their address being used to generate the winner

3. Users can revert their goOnStageOrBattle transaction if the number doesn't favor them.

Impact

Any user can know the random number ahead of time.

Recommendations

consider using a cryptographically provable random number generator such as Chainlink VRF