Submission Details
Severity:
Weak sources of Randomness
Summary
Using block.timestamp and block.prevrandao as a sources of randomness is not advised, as the outcome can be manipulated by the miners or validators.
Vulnerability Details
https://github.com/Cyfrin/2024-06-Dussehra/blob/main/src/ChoosingRam.sol#L51-L52
uint256 random =
uint256(keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender))) % 2;
Here, we see that block.timestamp and block.prevrandao are used in order to generate a random number. However, use of block.timestamp and block.prevrandao is insecure and not advised.
Impact
Incorrect randomness
Tools Used
Manual Review
Recommendations
Using external sources of randomness via oracles like Chainlink VRF.
Updates
Lead Judging Commences
bube over 1 year ago
Submission Judgement Published Reason: Too generic
Assigned finding tags:
Weak randomness in `ChoosingRam::increaseValuesOfParticipants`
Rewards breakdown
nSLOC
218This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.