Submission Details
Severity:
Battle manipulation risk due to using on-chain blockchain data to generate randomness
Summary
Using blockchain on-chain data to generate randomness allows battle manipulation.
Vulnerability Details
RapBattle uses blockchain on-chain data to generate the random number that will be used to determinate the winner.
These data are publicly accessible on the blockchain. Which means easily manipulable, and so the winner of the battle via random.
File: src/RapBattle.sol
uint256 random =
uint256(keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender))) % totalBattleSkill;
Impact
The battle issue can be manipulated at will to favor a particular rapper.
Tools Used
Manual review
Recommendations
Use off-chain data to generate random.
Rewards breakdown
nSLOC
201This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.