First Flight #10: One Shot
First Flight #10
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Weak randomness in `RapBattle::_battle` can be exploited by an attacker to skew the results in their favour.

ebok21

Description

Use of onchain values like block.timestamp, block.prevrandao and msg.sender to generate a random number in RapBattle::_battle for selecting the winner of the battle can be manipulated or predicted by malicious users/validators.

function _battle(uint256 _tokenId, uint256 _credBet) internal {
// code
​
uint256 random =
@> uint256(keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender))) % totalBattleSkill;
​
// some more code
}

Impact

An attacker could predict and manipulate these values to essentially win the battle every single time and game the system.

Proof-of-Concept

  1. Validators can predict when and how to participate by knowing the block.timestamp and block.prevrandao in advance and leverage that to win more.

  2. Users can manipulate the msg.sender value to make sure they win.

Tools Used

Slither

Recommended Mitigation

Use Chainlink VRF for generating a verifiable random number.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Weak Randomness

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.