Summary

Using block.timestamp for generating randomness is insecure because miners can influence the block timestamp to some extent.

Impact

This can potentially be exploited to manipulate the outcome of the randomness.

Tools Used

Manual review

Recommendations

Implement a secure randomness provider, like Chainlink VRF.