Submission Details
Severity:
Mystery Box Vulnerability
Summary: Weak PRNG(Pseudo random number generator).
PRNGs are often used for generating random numbers in smartContract. But, how ever certain sources used in this generators can make them easily predictable making them "weak"
Vulnerability Details:
function openBox() public {
require(boxesOwned[msg.sender] > 0, "No boxes to open");
// Generate a random number between 0 and 99
uint256 randomValue = uint256(keccak256(abi.encodePacked(block.timestamp, msg.sender))) % 100;
Impact: A malicious miner can call the openBox() in thier own trabsaction and the, mine the block themselves.
As miners they can they can reorder transactions within the block and select a block hash( block.blockhash(10000)) that ensures a desired outcome when % 10 is calculated.
By doing this they can "win" the game as they can influence the random value to be a predictable one.
Tools Used: Slither
Recommendations: The chainlink VRF is a better option because it provides cryptographically random numbers.
Avoid using miner-influenced-variables like, blockhash, block.timestamp or now for randomness.
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.