First Flight #10: One Shot

Summary

In the 'RapBattle__battle' function there is a randomness, in this function the value 'random' is given by encoding the block.timestamp, block.prevrandao and the msg.sender. This is not recommended because miners can modify these values.

Impact

Miners or hackers can modify the values block.timestamp, block.prevrandao and the msg.sender, trying to get a number higher than 'defenderRapperSkill' in this function. Doing so, those people win have the capacity to win every battles and so earn many tokens.

Tools Used

Static Analysis, Slither

Recommendations

Do not encode the values block.timestamp, block.prevrandao and the msg.sender, instead use chainlink VRF.