First Flight #10: One Shot

Summary

The randomness to select a winner in _battle:: RapBattle.sol can be gamed and a person can decide whether the challenger or defender is win when there
battle skills match.

Vulnerability Details

Because all the variables to get a random winner on the contract are blockchain variables and are known, a malicious actor can use a smart contract to game the system and receive the funds and improving its winning status.

Impact

Critical

Tools Used

Foundry

Recommendations

Use Chainlink's VRF to generate a random number to select the winner.