Submission Details
Severity:
Weak randomness in ChoosingRam::increaseValuesOfParticipants allows anyone to increase value to become ram
Vulnerability Details
Hashing msg.sender, block.prevrando, block.timestamp together creates a predictable final number. A predictable number is not a good random number. Malicious users can manipulate these values or know them ahead of time to increase the value and become Ram themselves.
Impact
Any user can become the Ram of Dussehra, winning the money and increasing the value of their participation. All characteristics have the same true value since you can choose the Ram.
Tools Used
Manual Review
Recommendations
Consider using an oracle for your randomness like Chainlink VRF.
Updates
Lead Judging Commences
bube over 1 year ago
Submission Judgement Published Reason: Too generic
Assigned finding tags:
Weak randomness in `ChoosingRam::increaseValuesOfParticipants`
Rewards breakdown
nSLOC
218This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.