First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

The `ChoosingRam` contract uses Weak Cryptographic random number generation which could lead to manipulation by malicious validators.

poolig4n

Description

The contract ChoosingRam uses Weak Cryptographic random number generation to choose between a challenger and a participant in the ChoosingRam::increaseValuesOfParticipants function and also in the function ChoosingRam::selectRamIfNotSelected to select Ram. This could allow a malicous validator to manipulate the outcome of the functions, potentially influencing the winner of the event.

  • ChoosingRam::increaseValuesOfParticipants and / or,

  • ChoosingRam::selectRamIfNotSelected

Impact

The winner of the event could be manipulated by malicious validators leading to a higher chance of their desired player becoming Ram and winning the money.

Proof of Concept
ChoosingRam::increaseValuesOfParticipants

uint256 random =
uint256(keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender))) % 2;

ChoosingRam::selectRamIfNotSelected

uint256 random = uint256(keccak256(abi.encodePacked(block.timestamp, block.prevrandao))) % ramNFT.tokenCounter();

Recommended mitigation

Use a purpose built, trusted and well tested library for random number generation.

References
https://github.com/Cyfrin/2024-06-Dussehra/blob/9c86e1b09ed9516bfbb3851c145929806da75d87/src/ChoosingRam.sol#L51

https://github.com/Cyfrin/2024-06-Dussehra/blob/9c86e1b09ed9516bfbb3851c145929806da75d87/src/ChoosingRam.sol#L90

Tools Used

  • Manual Review

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Weak randomness in `ChoosingRam::selectRamIfNotSelected`

The organizer is trusted, but the function `ChoosingRam::selectRamIfNotSelected` uses a way to generate a random number that is not completely random.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.