First Flight #17: Dussehra

Summary

Weak randomness in ChoosingRam::increaseValuesOfParticipants allows users to ensure their Ram NFT is the one being improved.

Vulnerability Details

Hashing block.timestamp, block.prevrandao, and msg.sender together creates a predictable random number. Malicious users can manipulate these values or know them ahead of time to ensure their Ram NFT is being improved and not another participants.

See Security Considerations section in EIP-4399 regarding Biasability and Predictability when using block.prevrandao to create a random number.

Impact

Any user can influence which Ram NFT is selected as the winning Ram, winning the money and making the whole competition worthless if it becomes a gas war regarding who can call this function and improve their Ram the fastest.

Tools Used

Slither

Recommendations

Consider using a cryptographically provable random number generator like Chainlink VRF