Summary

RapBattle._battle() has a weak random number generator based on block.timestamp and block.prevrandao which can give an advantage to miners/validators.

Vulnerability Details

Referred code:

Relying on block.timestamp is risky for a few reasons as node validators/miners have privileges that may give them unfair advantages.
The validator selected for a transaction has the power to:
Hold or delay the transaction until a more favorable time
Reject the transaction because the timestamp isn't favorable

Timestamp manipulation has become less of an issue on Ethereum, since the merge, but it isn't perfect. Other chains, such as Arbitrum can be vulnerable to several seconds of slippage putting randomness based on block.timestamp at risk.

-- quoted from Cyfrin Updraft :-) --

Impact

Impact is high as user can lose funds, likelihood low.

Tools Used

Slither

Recommendations

One could use Chainlinks VRF.