First Flight #10: One Shot

Description: Hashing msg.sender, block.timeStamp and bloc.prevrandao together creates a predictable final number. A predicatable number is not a good random number. Malicious users can manipulate these values or know them ahead of time to choose the winner of the Rap battle themselves.

Impact: Any user can influence the winner of the rap battle thus winning both the defender and challenger's bets. This would make the entire protocol worthless if it becomes a gas war as to who wins the rap battle.

Proof of Concept:

1. Validators can know ahead of time the block.timestamp and block.difficulty and use that to predict when/how to participate. See the solidity blog on prevrandao.

2. User can mine/manipulate their msg.sender value to result in their address being used to generate the winner!

3. Users can revert their _battle transaction if they dont like the winner.

Using on-chain values as a randomness seed is a well-documented attack vector in the blockchain space.

Recommended Mitigation: Consider using a cryptographically provable random number generator such as Chainlink VRF.