First Flight #17: Dussehra

Summary

Hacker can exploit the randomness in ChoosingRam::increaseValuesOfParticipants.

Vulnerability Details

The method ChoosingRam::increaseValuesOfParticipants contains logic for extracting random number which has predictable parameters - block.timestamp, block.prevrandao, ramNFT.tokenCounter(). This means that a hacker can use those parameters to predict a moment which will upgrade the NFT of the agument tokenIdOfChallenger.
Same could be said fot the method ChoosingRam::selectRamIfNotSelected but as long as the organiser remains "innocent" that wouldn't be a problem.

Impact

A hacker can use the predictable parameters to call ChoosingRam::increaseValuesOfParticipants in a moment when the function call upgrades the NFT of the agument tokenIdOfChallenger instead of taking chances as the function is intended to.

Tools Used

Manual Review

Recommendations

Use off chain randomness generator such as Chainlink VRF.