First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Weak Randomness in `ChoosingRam.sol`

modey

Summary

The randomness needed in ChooosingRam::increaseValuesOfParticipants and ChoosingRam::selectRamIfNotSelected is gotten from method that can be manipulated to ensure some predictability and defeat the purpose of randomness.

Vulnerability Details

The protocol relies on:

uint256 random =
uint256(keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender))) % 2;

To generate a random number. But this randomness is weak because block.timestamp and block.prevrandao are values that can be manipulated by validators/miners.

Impact

Since this method is used to determine the selected ram, A malicious user can exploit it and have an advantage.

Tools Used

Manual

Recommendations

Consider using ChainlinkVRF as a way to get randomness in the contract

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Too generic
Assigned finding tags:

Weak randomness in `ChoosingRam::increaseValuesOfParticipants`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.