First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

`ChoosingRam::selectRamIfNotSelected` can be manipulated via MEV to set `selectedRam` to a desired value.

feder

Summary

The random function used by selectRamIfNotSelected is deterministic and could therefore be manipulated by validators to set the selectedRam variable to a desired value.

Vulnerability Details

Assuming Ram has not been selected during the duration of the Dussehra event, the organizer can call the selectRamIfNotSelected function to randomly select a Ram from the list of minted NFTs.

While the transaction is in the mempool, a validator could hold the transaction to be included in a block until certain conditions are met, allowing them to manipulate the function:

uint256 random = uint256(keccak256(abi.encodePacked(block.timestamp, block.prevrandao))) % ramNFT.tokenCounter();

to return a desired tokenId. This manipulation could potentially create an NFT with desired characteristics when selected as the winner.

function selectRamIfNotSelected() public RamIsNotSelected OnlyOrganiser {
if (block.timestamp < 1728691200) { // 12th October
revert ChoosingRam__TimeToBeLikeRamIsNotFinish();
}
if (block.timestamp > 1728777600) { // 13th October
revert ChoosingRam__EventIsFinished();
}
uint256 random = uint256(keccak256(abi.encodePacked(block.timestamp, block.prevrandao))) % ramNFT.tokenCounter();
// @audit This could be manipulated to create an NFT with desired characteristics.
selectedRam = ramNFT.getCharacteristics(random).ram;
isRamSelected = true;
}

Impact

A validator could be incentivized to delay the transaction until a specific tokenId is selected, thereby gaining the ability to collect 50% of the fees collected by the protocol.

Tools Used

Manual review.

Recommended Mitigation

Implement Chainlink VRF to receive an off-chain randomly generated value, enhancing the randomness and reducing the risk of manipulation.

Updates

Lead Judging Commences

bube Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Weak randomness in `ChoosingRam::selectRamIfNotSelected`

The organizer is trusted, but the function `ChoosingRam::selectRamIfNotSelected` uses a way to generate a random number that is not completely random.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.