NFT paintings are dependant on the tokenId and not random
Summary
The protocol documentation states that get a cool account abstraction wallet, with a random Mondrian art painting!. However, the code at Line 165 of MondrianWallet.sol we can use that no random number is used. The number of the art painting is related and derived from to the tokenId.
Vulnerability Details
One of the four paintings is calculated on the basis of the tokenId as defined in Line 165: uint256 modNumber = tokenId % 10;. This means that the paintings is not randomly distributed. The art paintings will be given in a consecutive order.
Impact
This happens on each MoondrianWallet creation.
Tools Used
Manual Review
Recommendations
Use random number generator instead of tokenId at Line 165 of MoondrianWallet.sol.
Lead Judging Commences
NFTs are not random
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.