First Flight #10: One Shot

Summary

Weak Randomness in the RapBattle.sol::_battle can result in a predictable winner or be influenced by users.

Vulnerability Details

Because hashing block.timstamp, msg.sender, block.prevando does not create a random number.

Instead, it creates a predictable number, Malicious contracts can manipulate this function and predict the winner of the rapBattle. This can break the system eventually

Impact

A Malicious attacker can attack this function and be able to predict the winner of the rapBattle. This will break the system and reward the wrong users in the rapBattle.

Tools Used

Manual Review

Recommendations

Weak Randomness is a popular attack vector, so it is always advised to use Oracles like Chainlink VRF to generate random numbers for on-chain purposes.