Weak randomness allows organiser to select which player to be Ram
Summary
Hashing block.timestamp and block.prevrandao together creates a predictable number, and a predictable number is not a good random number.
Vulnerability Details
A malicious organiser could use the function ChoosingRam::selectRamIfNotSelected to choose which RamNFT becomes ChoosingRam::selectedRam.
Impact
This would make the game rigged, allowing the organiser to choose a player of its own to be Ram and withdraw the prize.
Tools Used
Manual review
Recommendations
Implement Chainlink VRF for true randomness
Lead Judging Commences
Weak randomness in `ChoosingRam::selectRamIfNotSelected`
The organizer is trusted, but the function `ChoosingRam::selectRamIfNotSelected` uses a way to generate a random number that is not completely random.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.