Mystery Box

Vulnerability Details

Let's see the following code below

From the code above, we know that every user can open the box whenever they want. This code computes the randomValue statically from msg.sender and block.timestamp. From this, it is easy for users to achieve the best randomValue.

Impact

Users can predict or manipulate the outcome of the randomValue, allowing them to consistently receive the best rewards, such as gold coins. This undermines the fairness of the contract and can lead to exploitative behavior, resulting in financial losses for other users and the integrity of the system.

Tools Used

Manual review.

Recommendations

Implement a secure randomness oracle like Chainlink VRF (Verifiable Random Function) to generate unpredictable random values. This will enhance the security and fairness of the reward distribution.