Beginner FriendlyFoundryNFT
100 EXP
View results
Submission Details
Severity: high
Valid

`RapBattle.sol::_battle` has a weak PRNG, leading to a challenger manipulation of the battle results

  • Description:

    • Weak PRNG due to a modulo on block.timestamp, now or blockhash. These can be influenced by miners to some extent so they should be avoided.

  • Impact:

    • A challenger can manipulate the battle result to won the bet.

  • Proof of Concept:

    • Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#weak-PRNG

  • Recommendation:

    • Do not use block.timestamp, now or blockhash as a source of randomness

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Weak Randomness

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.