First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Weak randomness in `ChossingRam::selectRamIfNotSelected` allows organiser to influance or predict the winner and influance and become the Ram.

badal_sharma09

Description: Hashing msg.sender, block.timestamp, and block.prevrandao together create a predictable find number. A predictable number is not a good random number. Malicious users or organiser can manipulate these values and become winner or Ram themselves.

function selectRamIfNotSelected() public RamIsNotSelected OnlyOrganiser {
if (block.timestamp < 1728691200) {
revert ChoosingRam__TimeToBeLikeRamIsNotFinish();
}
if (block.timestamp > 1728777600) {
revert ChoosingRam__EventIsFinished();
}
uint256 random = uint256(keccak256(abi.encodePacked(block.timestamp, block.prevrandao))) % ramNFT.tokenCounter();
selectedRam = ramNFT.getCharacteristics(random).ram;
isRamSelected = true;
}

Impact: The organiser can influence the selection of Ram if not selected by the user, winning the money. Making the entire Dussera worthless.

Proof of Concept:

  1. Validators predicting block timestamp and block prevrandao can significantly manipulate their participation.

  2. The organiser can modify their message sender value, making their address the preferred one to determine the selected RAM if not selected by the user.

  3. Transactions, such as select Ram if not selected, can be reverted by users if the result doesn't meet their satisfaction.

Recommended Mitigation: A cryptographically verifiable random number generator, such as Chainlink VRF, could substantially mitigate such issues.

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Weak randomness in `ChoosingRam::selectRamIfNotSelected`

The organizer is trusted, but the function `ChoosingRam::selectRamIfNotSelected` uses a way to generate a random number that is not completely random.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.