First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

`ChoosingRam.sol::increaseValuesOfParticipants` is not verifiably random when choosing who's values will be increased

coffee

Summary

In ChoosingRam.sol::increaseValuesOfParticipants, when the Challenger's or Participant's ramNFT traits are being chosen to be increased, it is not done in a verifiably random way.

Vulnerability Details

When the winner is calculated, it uses properties of the Ethereum blockchain such as msg.sender, block.timestamp, and block.prevrandao to create a seed for the keccak256 hash function. The result is then used to compute a random value of either 0 or 1 to determine the winner.

Calculating a random number like this does provide a level of randomness; however, the data could potentially be manipulated through miner manipulation.

uint256 random =
@> uint256(keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender))) % 2;

Impact

Potential manipulation when determining the winner. The winner is picked using values that can be manipulated unfairly rather than by using a service that picks a verifiably random number.

Tools Used

--Foundry

Recommendations

Use an Oracle service such a Chainlink VRF to select a random number to determine winner.

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Too generic
Assigned finding tags:

Weak randomness in `ChoosingRam::increaseValuesOfParticipants`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!