Mystery Box

Summary

User can predict when they can buy a high value box and get profit

Vulnerability Details

In openBox function, the value determine which value the box has is uint256 randomValue = uint256(keccak256(abi.encodePacked(block.timestamp, msg.sender))) % 100;. So user can pre-calculate which block user should call to get the right randomValue to get high value box

Impact

User can always get high value box, break the contract logic, and get profit from contract

Tools Used

Manual review

Recommendations

Shouldn't use block.timestamp as a secret, please use other data off-chain or oracle