First Flight #17: Dussehra

Summary

The ChoosingRam::selectRamIfNotSelected function uses a modulo operation for randomness, which can lead to unfairness where certain tokens may have a lower probability of being selected.

Vulnerability Details

The function uses the following line to generate a random token ID:

This modulo operation (% ramNFT.tokenCounter()) can introduce bias if the token counter is not a power of two. For example, if ramNFT.tokenCounter() is not a power of two, some token IDs may have a slightly higher probability of being selected than others.

Impact

Certain tokens may have a lower probability of being selected, leading to an unfair selection process.

Tools Used

Manual review

Recommendations

Use a more uniform method for random selection to ensure all tokens have an equal chance of being selected. One approach is to use a secure randomness source like ChainLink VRF.