Submission Details
Severity:
User can steal the money in the contract because `random` is not really a random number.
Summary
The _battle function calculated a random uint256 based on block.timestamp, block.prevrandao, msg.sender and totalBattleSkill which is not a really random number.
Vulnerability Details
All of the values used to generate a random number can be predicted/calculated, furthermore block.prevrandao on Arbitrum returns 1.
This means a malicious user can calculate the outcome of a battle and use it to steal all the funds in the contract.
Impact
High as a malicious user can calculate the random number and use it to win battles.
Tools Used
Recommendations
Use Chainlink VRF or similar service.
Updates
Lead Judging Commences
inallhonesty almost 2 years ago
Submission Judgement Published Assigned finding tags:
Weak Randomness
Rewards breakdown
nSLOC
201This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.