First Flight #10: One Shot

Summary

Using block.timestamp, block.prevrandao, msg.sender together create a predictable final number. The prevrandao value itself is not a source of randomness but rather a part of the RANDAO mechanism that Ethereum uses to introduce randomness into the blockchain. It's the result of a consensus mechanism among validators and is known before a transaction is executed. This means that while it adds some unpredictability to your calculation, it's not a source of true randomness.

Vulnerability Details

Impact

Any user can influence or predict outcome of the _battle.

Proof of Concept

1. Validators can know ahead of time the block.timestamp and use that knowledge to predict when / how to participate. See the solidity blog on prevrando here.

2. The msg.sender is predictable within the context of a transaction.

3. The security and predictability of prevrandao are well-documented. Validators have some influence over the prevrandao value, which can be exploited to some extent. For instance, if a validator has control over a significant number of blocks, they can influence the prevrandao value in those blocks. Additionally, the predictability of prevrandao increases if validators know the outcome they want and choose not to propose blocks that would lead to a different prevrandao value.

Recommendations

Consider using an oracle for your randomness like Chainlink VRF.