Challenger can become the ram for the event by guessing the random number used in `Choosing::increaseValuesOfParticipants` function
Summary
Challenger can become the ram for the event by guessing the random number used in Choosing::increaseValuesOfParticipants function
Vulnerability Details
Using block.number and block.timestamp as a source of randomness is a bad practice, as the outcome can be manipulated by calling contracts. In this case the Choosing::increaseValuesOfParticipants function can be called by a challenger who has precomputed the random number to know if he wins or not before calling the function and thereby ensures he becomes Ram for the event
Impact
A challenger can unfairly become the ram for the event
Tools Used
Manual Review
Recommendations
it is recommended that the protocol uses an external sources of randomness via oracles like Chainlink VRF. This would make it more difficult for an attacker to guess the value and precompute multiple block.number.
Lead Judging Commences
Weak randomness in `ChoosingRam::increaseValuesOfParticipants`
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.