First Flight #9: Soulmate
First Flight #9
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Weak Pseudo-Random Number Generation in ```Soulmate::readMessageInSharedSpace```

kiteweb3

Summary

The Soulmate::readMessageInSharedSpace function uses a weak PRNG to select a random word from the niceWords array. The PRNG is based on the block.timestamp modulo the length of the array, which is predictable.

Vulnerability Details

@> string[4] niceWords = ["sweetheart", "darling", "my dear", "honey"];
​
function readMessageInSharedSpace() external view returns (string memory) {
// Add a little touch of romantism
return
string.concat(
sharedSpace[ownerToId[msg.sender]],
", ",
@> niceWords[block.timestamp % niceWords.length]
);
}

Impact

function testNiceWordIsPredictable() public {
vm.warp(block.timestamp + 6);
console2.log("The block.timestamp is:", block.timestamp);
​
vm.startPrank(soulmate1);
soulmateContract.writeMessageInSharedSpace("Buy some eggs");
vm.stopPrank();
​
string memory expected = string.concat("Buy some eggs", ", ", "honey");
​
assertEq(soulmateContract.readMessageInSharedSpace(), expected);
console2.log("The soulmate1 message is:", soulmateContract.readMessageInSharedSpace());
}
​
PASS] testNiceWordIsPredictable() (gas: 53035)
Logs:
The block.timestamp is: 7
The soulmate1 message is: Buy some eggs, honey

The test shows that we can predict the niceWords.

The niceWords is defined as:

string[4] niceWords = ["sweetheart", "darling", "my dear", "honey"];

We set the block.timestamp as:

block.timestamp = 7

We can calculate the module:

block.timestamp % niceWords.length = 7 % 4 = 3

and predict the niceWord:

niceWords = [3] = honey

Tools Used

Manual review

Recommendations

Consider using a more secure source of randomness as Chainlink VRF provided by a trusted oracle service.

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.