First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Bad randomness in `increaseValuesOfParticipants`

yaioxy

Summary

The ChoosingRam::increaseValuesOfParticipants function uses a predictable and manipulable source of randomness, leading to unfair and biased outcomes.

Vulnerability Details

The function relies on block.timestamp, block.prevrandao, and msg.sender to generate a random number. These sources are predictable and can be manipulated by the caller, resulting in biased and unfair randomness.

uint256 random = uint256(keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender))) % 2;

Impact

The challenger can win by entering when the random number is 0.

Tools Used

Manual review

Recommendations

Use a more secure source of randomness, such as Chainlink VRF (Verifiable Random Function), to ensure that the random number generation is truly random and cannot be manipulated.

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Too generic
Assigned finding tags:

Weak randomness in `ChoosingRam::increaseValuesOfParticipants`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!