First Flight #17: Dussehra

Summary

Pseudo randomness in ChoosingRam::increaseValuesOfParticipants leads to unfair advantages for challenger users.

Vulnerability Details

In blockchain randomness similar to that in the above function is predetermined
uint256 random = uint256(keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender))), so any user can know the "random number" beforehand. For randomness to be generated in a blockchain something like Chainlink VRF is required.

Impact

The user can pre-run the code locally with the arguments which return the random number, see if they will be the winner, and then decide if they will call
ChoosingRam::increaseValuesOfPartints. That leads to an unfair advantage for the user.

Tools Used

Manual Review

Recommendations

Replace the pseudo-randomness with Chainlink VRF.