First Flight #10: One Shot

Summary

The RapBattle::_battle function includes block.timestamp and block.prevrandao as a source of randomness to determine rap battle winners. However using variables that provide information about the blockchain properties as a random number generator is commonly advised against, as the outcome can be manipulated by calling accounts.

Vulnerability Details

Imagine the following scenario:

1. An attacker can run a strong miner/validator node in the blockchain network, as they can know the block.timestamp and block.prevrandao in ahead of time and use that advantage to calculate if he will win or decide whether to participate or not in the rap battle.

2. Additionally msg.sender is also used in determining the result. So an attacker can manipulate their address value to gain a winning position.

Impact

Likelihood: Medium, although the user has incentive to exploit this, certain circumstances must be met to succeed.
Impact: High as malicious validator can influence on these variables to gain benefit. An attacker basically can win unfairly.

Tools Used

Manual Review

Recommendations

Use decentralized oracle for generation of randomness, such as Chainlink VRF.