Weak randomness allows player to increase characteristics without risking to lose a challenge
Summary
Hashing block.timestamp, block.prevrandao and msg.sender together creates a predictable number, and a predictable number is not a good random number.
Vulnerability Details
A malicious player could call ChoosingRam::increaseValuesOfParticipants without risking to lose a challenge, and achieve easily the highest characteristics and become ChoosingRam::selectedRam
Impact
None really, because the ChoosingRam::increaseValuesOfParticipants function doesn't set the ChoosingRam::isRamSelected boolean as true, making the function ChoosingRam::selectRamIfNotSelected the only one that matters for selecting Ram. But if that was patched, it would be a severe vulnerability that allows any player to become Ram.
Tools Used
Manual review
Recommendations
Implement Chainlink VRF for true randomness
Lead Judging Commences
Weak randomness in `ChoosingRam::increaseValuesOfParticipants`
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.