ChoosingRam::increaseValuesOfParticipants
Description:
The increaseValuesOfParticipants
function in the ChoosingRam
contract utilizes a weak source of randomness to determine the outcome of challenges between participants. This randomness is derived from block.timestamp
, block.prevrandao
, and msg.sender
's address, all of which are publicly known values. Consequently, attackers can predict the outcome of the randomness generation, enabling them to always win challenges by calling the function at opportune moments.
Impact:
The lack of true randomness in this function allows malicious actors to manipulate the game mechanics, ensuring they can always emerge victorious in challenges. This undermines the fairness and integrity of the system, potentially discouraging honest participation.
Proof of Concept:
An attacker can deploy a contract similar to Attack::attackRandomness
to exploit this weakness. By calculating the expected outcome of the randomness generation beforehand, the attacker can ensure victory whenever they participate in a challenge.
Tools Used:
Manual Review
Recommended Mitigation:
To address this vulnerability, it is recommended to use Chainlink's Verifiable Random Function (VRF) for generating truly random numbers. Chainlink VRF provides cryptographic proof of the randomness generated, ensuring that outcomes cannot be predicted or manipulated by any party involved.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.