First Flight #10: One Shot

Summary

Hashing msg.sender, block.timestamp, block.prevrandao together creates a predictable final number. A predictable number is not a good random number. Malicious users can manipulate these values or know them ahead of time to choose the winner .

Impact

Any user can choose the winner by manipulating his skill set.

Proof of Concept:

Validators can know ahead of time the block.timestamp and block.difficulty and use that knowledge to predict when / how to participate. See the solidity blog on prevrando here. block.difficulty was recently replaced with prevrandao.

Using on-chain values as a randomness seed is a well-known attack vector in the blockchain space.

Tools Used

Manual Review, Foundry

Recommendations

Use of provable random number like the chainlink VRF which a verifiable random number produced off-chain and a proof is sent on chain, which allows the miners to verify its randomness