Summary

Using prevrandao will not produce the desired effects in some of the other chains affecting the randomness generator functions. It also is predictable and not recommended in this case.

Vulnerability Details

From the Arbitrum docs: block.prevrandao Returns the constant 1.
From the zksync docs : Returns a constant value of 2500000000000000 on zkSync Era.

It was also only introduced in solidity 0.8.18, and while the contracts specify 0.8.20, the test contract could run 0.8.13.

Impact

This affects whatever randomness that was coded into the contracts and means that tokenIdOfAnyPerticipent will always be chosen in the increaseValuesOfParticipants function for example.

Tools Used

Chrome

Recommendations

Use a better way of generating random data, such as the Chainlink VRF : https://docs.chain.link/vrf/v2/subscription/examples/get-a-random-number